POSTMORTEM: The Great Outlook Incident Of Q3

A reconstructed incident report, obtained by Cybersecurity Smith.

Severity: SEV-1
Duration: 4 hours, 17 minutes
Affected systems: Microsoft Outlook (corporate)
Affected users: All of them, loudly

13:42 — Karen in Marketing reports Outlook is "doing the thing again."

13:43 — Help Desk asks what "the thing" is. Karen escalates by calling her manager.

13:51 — Security Operations Center detects "anomalous email behavior" and opens a P1. SOC analyst Tyler M. suspects nation-state actor.

13:52 — Sysadmin Dave Karlsen notices Outlook is broken. Begins investigation by, in his words, "looking at it."

14:04 — Tyler M. files a P1 ticket with IT requesting they "engage incident response protocols and consider isolating the affected hosts."

14:05 — Dave restarts the Exchange connector.

14:06 — Outlook works.

14:07 — Tyler M. files a follow-up ticket asking for IOCs and a forensic image.

15:11 — CISO Brad Thornwell-Pierce is briefed on the incident. He requests a full RCA, a tabletop exercise, and "a moment of reflection." He schedules a meeting for the following Tuesday at 9 AM.

17:59 — Dave goes home. Has not spoken in three hours.

Tuesday, 9:00 AM — Tabletop exercise begins. Dave is not invited. Brad presents 47 slides on "Lessons Learned." Lesson #1: "We must invest in resilient email infrastructure." Lesson #14: "Communication is key." Lesson #47: "Our culture of security made the difference."

Root cause (per official report): "Sophisticated availability event impacting electronic mail systems. Mitigated through coordinated response across security and IT teams."

Root cause (per Dave): "The connector. It was the connector. It's always the connector."