A recent outage of Microsoft 365, a suite of productivity tools, affected several services including Outlook, Teams, and SharePoint Online, causing disruptions for businesses and administrations worldwide. The incident, which occurred on November 12 and 13, was attributed to an unexpected reduction in capacity of Microsoft's global infrastructure. According to Microsoft, a saturated process on the affected servers exacerbated the degradation, but the company did not classify the incident as a cyberattack.
The Computer Emergency Response Team of Mauritius (CERT-MU) issued a high-level security alert on November 13, confirming difficulties in accessing certain communication and collaboration services. However, CERT-MU Director Dr. Kaleem Usmani assured that public services were not affected and no operational disruptions were reported. The incident has raised questions about the preparedness of Mauritian organizations to handle prolonged outages of their primary digital tools.
The outage has highlighted a weakness in the IT strategy of many Mauritian businesses, according to Dr. Didier Samfat, a cybersecurity specialist. He notes that several organizations rely heavily on Microsoft 365 for their communication and collaboration services, centralizing their emails, documents, and data in a single environment often hosted abroad. This setup exposes companies to two major risks: interruption of activities and loss of control over their data.
Codarren Velvindron of Cyberstorm.mu shares similar concerns, noting that Microsoft 365 has become an essential component of daily business operations in Mauritius. He describes the risk as a "single point of failure" systemic issue, where a failure by the provider simultaneously affects its clients. Velvindron emphasizes that the problem lies not in using Microsoft, but in considering a cloud provider as infallible.
Both specialists agree that many organizations in Mauritius underestimate the risks associated with relying on a single provider. They prioritize revenue and immediate profitability over cybersecurity and IT resilience. Certain sectors, such as banking, telecommunications, healthcare, and public services, are particularly exposed, according to Samfat. He advises executives to determine their organization's Recovery Time Objective (RTO), the maximum time allowed to restore systems after an interruption.
To mitigate these risks, Velvindron recommends having independent means to communicate, access essential data, and continue operations when the primary provider becomes unavailable. He suggests exploring alternatives such as Google Workspace, open-source solutions like Nextcloud, and hybrid architectures combining public cloud and local infrastructure. Samfat advocates for a diversification strategy, ideally having three providers for critical functions.
The incident has also sparked discussions about Mauritius' ongoing project to develop a sovereign cloud, which aims to enhance the country's digital sovereignty. As the country continues to navigate its digital landscape, experts stress the importance of prioritizing cybersecurity, IT resilience, and diversification to minimize the risks associated with digital dependency.
Key points
- The Microsoft 365 outage affected several services, including Outlook, Teams, and SharePoint Online, causing disruptions for businesses and administrations worldwide.
- The incident highlights the risks associated with relying on a single provider for essential services, including interruption of activities and loss of control over data.
- Experts recommend diversification and having independent means to communicate, access essential data, and continue operations when the primary provider becomes unavailable.
