While the temporary unavailability of email services does not seem to affect video security and access control systems—at least not in obvious ways—there are, however, implications and lessons to learn with everyone involved in professional security systems in times of heightened cybersecurity risks.
While the temporary unavailability of email services does not seem to affect video security and access control systems—at least not in obvious ways—there are, however, implications and lessons to learn with everyone involved in professional security systems in times of heightened cybersecurity risks.
Microsoft attributes the outage to the “temporary unavailability of servers” while traffic demand stayed the same. A cyberattack would have the opposite signature: A typical swell in traffic demand while capacity stays the same, and thus gets overwhelmed.
Concretely, the current outage has several implications:
- Many cloud VMS and access-control platforms use Microsoft Entra ID for SSO. According to downdetector.com, services saw some interruptions—or rather hick-ups when compared to how much other Microsoft services have been affected. However, this does not mean doors that should have stayed closed opened (while others that should have opened stayed close): It is possible that some organizations have experienced trouble generating new credentials or updating existing ones as admins might not have been able to reach the management console. There have been no reports about far-reaching issues, though.
- Other security-relevant Microsoft products, such as Defender XDR, an integrated threat protection that combines data and automated response capabilities across physical security and IT, have also been affected. Concretely, an outage of this kind might look like this: Security staff cannot open the Defender portal, alerts and incident queues are not visible or arrive late, and automated response playbooks do not run. Agents on endpoints typically keep protecting devices locally, but telemetry and reporting lag behind. The real risk is the blind spot: Anything that happened during the outage will deserve a second look once the situation has stabilized.
- Alarms and notifications: If systems send automated alerts by email, for example in systems where access control and time attendance are integrated, they obviously don’t go out and/or get in right now. Whether delayed messages eventually arrive depends on the sending system. If an alert is handed to a mail server with a queue, it will usually keep retrying and be delivered, often in bulk and out of order, once service returns. Simple devices that send a single email and move on may drop the alert for good.
Even though the outage is, based on all available information, not the result of a cyberattack, it highlights the importance of what organizations should do to avoid systemwide effects of any one third-party service going dark:
- Avoid a single point of failure in identity. Keep tested, securely stored local “break-glass” admin accounts, and make sure door controllers and cameras keep working with cached credentials when the cloud login is unreachable.
- Don’t make email the only channel to get automated messages. Add a second route such as SMS, push notification or a phone call, and check that devices queue and retry messages rather than send them once. For messages of lesser importance, ensure the system does not automatically delete them if they don’t get out.
- Know and rehearse the failure modes. Ask vendors which functions depend on third-party cloud services, document what fails safe or secure, and run a short drill so staff know what to do when the console is unreachable.
Let’s hope Outlook and all the other services affected will come back soon.