What the Microsoft Outlook outage reveals about risks, limitations and gaps in communication
“Modern society has become highly dependent on a small number of major cloud and technology providers,” says one expert.
The Microsoft sign at the company’s headquarters in Redmond, Washington, Jan 18, 2023. (File photo: Reuters/Matt Mills McKnight)
New: You can now listen to articles.
This audio is generated by an AI tool.
Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
SINGAPORE: The global Microsoft Outlook outage on Friday (Nov 13) highlighted the risks that can arise when many organisations depend on the same technology providers for critical functions, experts said.
Professor Boh Wai Fong from Nanyang Technological University (NTU) said companies have gravitated towards these vendors because of the efficiency, economies of scale and integration.
But such decisions also tend to result in an over-reliance on a single vendor. A major failure can then have ripple effects across the world.
Prof Boh described this as a “paradox of digital transformation”, where what may be optimal for an organisation may not necessarily be best for the entire ecosystem.
Mr Matthew Hardman, Asia-Pacific chief technology officer at Hitachi Vantara and a former Microsoft executive, said organisations have to plan for disruptions even when the underlying failure was outside their control.
“You can’t outsource risk,” he said. “Risk is something you have to own as an organisation.”
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
WHAT HAPPENED
The global Microsoft 365 outage on Friday disrupted services including Outlook, Teams and Copilot for more than half a day, affecting thousands of users and spilling into Asia-Pacific business hours.
Microsoft initially attributed the connectivity problems to an “elevated load” across its infrastructure, but later said this was caused by servers unexpectedly becoming unavailable, shifting demand onto those still operating.
The company is still investigating why the servers went offline and has said it is not aware of any malicious activity behind the disruption.
Microsoft reported partial recovery in some regions after adjusting traffic protocols, redistributing traffic and introducing targeted traffic-blocking measures, although the improvements were not sustained.
In Singapore, some government systems and the email services of several banks were affected, while emergency services and Singpass remained operational.
CLOUD VULNERABILITIES
Associate Professor Anupam Chattopadhyay from the College of Computing and Data Science at NTU cautioned that it was still too early to comment on potential vulnerabilities without a detailed root-cause analysis.
He said Microsoft’s services operate across a complex ecosystem involving servers, software, database management and other tools, with physical infrastructure also distributed across different locations.
“While such cloud infrastructure is designed to mitigate failures, this massive complexity also makes it very hard to quickly identify and repair a failure,” he added.
“Hence, a quick fix to the problem may trigger other problems that have led to this cascading failure effect.”
Professor Liu Yang, executive director of NTU’s Cyber Security Research Centre, said the outage highlighted a broader limitation of cloud infrastructure.
“Redundancy does not necessarily guarantee resilience, particularly when multiple services share underlying infrastructure or dependencies,” he said.
He added that there was a need for better mechanisms for fault isolation, automated recovery and continuity of critical operations.
While the full root cause has yet to be established, he said the broader lesson was that cybersecurity needed to encompass not only protection against attacks, but also the resilience and dependability of increasingly interconnected digital and AI infrastructure.
DEPENDING ON ONE PROVIDER
For businesses, one of the bigger questions raised by the outage is how much of their operations depend on a single technology provider.
Prof Liu said: “Modern society has become highly dependent on a small number of major cloud and technology providers.
“When one of these platforms experiences a major disruption, the impact can cascade across businesses, governments and essential services worldwide.”
Assoc Prof Chattopadhyay said the clearest weakness exposed by the disruption was the “heavy, single-pointed reliance on technology providers”.
“The manifestation of this outage is affecting every industry, including critical ones and we have no fallback plan,” he said.
He added that no single service provider can give complete assurance of uninterrupted uptime, and that organisations needed to consider what would happen if the disruption lasted more than a day.
Mr Nicky Choo, vice-president and general manager for Asia-Pacific at cybersecurity firm Mimecast, said the implications go beyond employees being unable to send emails or join online meetings.
Technology underpins many day-to-day business processes, including collaboration between colleagues and communication with customers, he said.
“If you’re unable to access digital services in one way or another … there is a huge and tremendous business impact,” he said.
Prof Boh said businesses should instead identify their critical dependencies and make sure there are redundancies for functions that have to keep operating during an outage.
She also warned that such dependencies could become more significant as artificial intelligence takes on more business processes.
Today, a technology outage may stop employees from accessing information or communicating by email, she said. As agentic AI increasingly automates workflows, similar disruptions could eventually halt entire processes.
She added that if employees were not trained to take over such workflows during disruptions, organisations could face greater impact, particularly as workers risk losing the skills and organisational knowledge needed to step in when technology fails.
WHAT NEEDS TO BE DONE
Experts said organisations should first identify which systems are essential to keeping their operations running and which services they could temporarily do without.
Mr Hardman described this as identifying a “minimal viable business” and deciding which systems are “mission critical”.
Businesses should also test different disruption scenarios regularly rather than treating resilience planning as a one-off, he said.
“What does happen if our communication protocols go down for email? How do we build resilience into our existing plan?” he said, describing the kinds of scenarios organisations should test for.
Assoc Prof Chattopadhyay said businesses should think about two areas during an outage: data and communication.
Past emails and attachments should be backed up and recoverable, while organisations should have an alternative internal communication channel if their usual one fails, he said.
He added that organisations should consider distributing risks across service providers.
Cloud providers should also improve stress-testing and, over the longer term, allow customers to run operations smoothly across multiple vendors, without locking them in.
Prof Boh said business continuity planning should also extend beyond the point when technology is restored.
“Even with the tech restored, organisations will still need to deal with backlogs and delayed decisions,” she said.
Organisations therefore need to establish and test such business continuity plans, so that they are clear on what actions need to be taken in such outages as well as after the outage.
Source: CNA/jw(mi)
Sign up for our newsletters
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST
Tap here to return to FAST
FAST
