# 2023 Data Disaster Horror Stories

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night! We’re also offering 20% off on Macrium Reflect Home Annual plans until Halloween. (And what’s the spooky season without some scary movies? How many references can you spot?)

## [3CX attacked in all new way](https://www.wired.com/story/3cx-supply-chain-attack-times-two "wired.com")

It's enough to make you Scream. State-sponsored attacks aren’t a new threat, but when a group associated with North Korea attacked VoIP company 3CX, they made history. Over half a million 3CX customers were affected thanks to a single employee’s PC being infected with a previously infected app. 

“This is the first time we've ever found concrete evidence of a software-supply-chain attack leading to another software-supply-chain attack,” says Mandiant Consulting's chief technology officer Charles Carmakal. “So this is very big, and very significant to us.”

Don’t Look Now, but this may be the first of many such events. 

## MGM Resorts and Caesars Entertainment

They’re heeeerrreee… Nope, it wasn’t a poltergeist in the slot machine, or a ghost in the elevator. Many sources point to ALPHV and Scattered Spider as the hacking groups who spun webs around two of the biggest casino resorts in the world, marking one of the biggest ransomware attacks in years. Not only were daily operations disrupted for days, the hackers were able to access personal information of many loyalty card members, including Social Security numbers. The MGM Resorts and Caesars Entertainment attacks have cybersecurity experts around the world doubling down on warnings about social engineering.

“[The hackers](https://fortune.com/2023/09/13/mgm-caesars-hacked-ransomware/ "fortune.com") first breached an outside IT vendor before gaining access to the company’s network…” 

Indeed, one of the most complex issues security pros face isn’t technical at all; it’s the end user. Technology like encryption and remote monitoring and management (RMM) has gotten so good, it’s becoming easier for hackers to target people themselves. Social engineering and phishing scams have always been consistent money makers for cyber criminals, but for a few days they made Las Vegas the Village of the Damned. 

## [UK Electoral Register](https://www.electoralcommission.org.uk/privacy-policy/public-notification-cyber-attack-electoral-commission-systems "electoralcommission.org.uk")

Get Out the Vote! While this one technically happened a few years ago, the public is only just finding out now. The United Kingdom's electoral registers fell victim to a “complex cyber-attack” which resulted in 40 million people’s personal information being compromised. Information like full names, email addresses, home addresses, and telephone numbers might not be critical info in of themselves, but if they were to be joined with other personal information gleaned in other ways, it certainly adds a few important pieces to the jigsaw puzzle that is our personal lives.  

## [Is AI already a hacking threat?](https://www.grantthornton.com/insights/articles/advisory/2023/anticipate-cybersecurity-and-privacy-risks-in-ai "grantthornton.com")

If 2023 tech had to be summed up all we’d need is two little letters: AI. A tsunami of hype and fear and speculation seemed to wash over all corners of the planet as ChatGPT and other AI platforms filled the social conversation. It really did seem like it was everywhere all at once. 

It’s not that an AI itself could start posing a direct threat (yet), but that its ease of use has made scamming so much easier for hackers around the world. Not only can they use AI to scale their schemes faster, but the software’s abilities help make the language they use in phishing emails sound native and natural. This means that even the most suspicious of us could fall victim, and parts of the world that have largely been ignored due to difficult language barriers are at greater risk. 

And all that’s not even touching on the Frankenstein’s Monster of Deepfake video and audio that looms in the future. 

## Natural disasters in the US

Beware The Fog and The Mist aren’t exactly threatening, but it’s important to note that not all data disasters are malicious. Natural disasters like fires, floods, earthquakes and hurricanes can have devastating consequences on life and property. But if data systems aren’t properly protected, that destruction may be even further reaching. 

From January 2023 to date, the United States alone has experienced over [23 separate billion dollar disasters](https://www.nytimes.com/2023/09/12/climate/billion-dollar-disasters.html "nytimes.com"). That’s over [$57 billion in damages](https://www.cnbc.com/2023/09/11/2023-severe-weather-57-billion-in-damage-and-253-people-dead-so-far.html "cnbc.com"), with a few months of the year left to go. As our climate changes and weather becomes more severe, it’s important to prepare for the unpredictable. 

## Avoid the Nightmare

If you’re ready to Let the Right One In and join millions of others who trust Macrium with their data, now is a great time to get started with our [Reflect Home Annual plan](/products/home). From now until October 31st, you can get your subscription for 20% off. That means you’ll get access to exclusive support, a free setup call with one of our team, all updates and fixes, plus entry to our customer forum and knowledgebase. 

And if you can’t get enough of the scary stories, be sure to check out our [previous posts](/blog?tag=halloween)!

2023-data-disaster-horror-stories.png

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night! 

Data Disaster Horror Stories from 2023

This Friday the 13th, we’re taking a look at some of the biggest and scariest data disasters of 2023. But don’t let these tales cost you sleep at night!

2023 Data Disaster Horror Stories

# What do we know about Windows 11’s security strategy?

_And more importantly, will it work?_

In previous posts [here](/blog/will-macrium-reflect-work-on-windows-11-63dc8e81b865) and [here](/blog/what-to-do-before-you-upgrade-to-windows-11-eab85153cf7a), we discussed how Macrium Reflect and Microsoft Windows 11 work together. In this article, we wanted to take a closer look at the new operating system itself, and what Microsoft’s choices indicate about their plans for what’s to come. But with many things, to get a clear picture of the future, one must briefly look at the past.

### Windows 10 Vulnerabilities

BeyondTrust, a company specializing in Privileged Access Management tools, recently released their annual Microsoft Vulnerabilities Report for 2020. The results were… not great.

> _“A total of 1,268 were reported, which marks a colossal 48% rise over the previous year (858). This is in fact the sharpest spike since the inception of the Microsoft Vulnerabilities Report, and means that, since 2016, total vulnerabilities have increased by 181%.” — [BeyondTrust](https://www.beyondtrust.com/blog/entry/microsoft-vulnerabilities-report "www.beyondtrust.com")_

In any system, in any structure, physical or digital, you’re only as strong as your weakest link. So what doesn’t come as a surprise in their report is how a large number of these exploits could be mitigated by simply removing certain administrative privileges. People — users — will always be the weakest point. BeyondTrust goes on to say:

> _“90% of Critical vulnerabilities in Internet Explorer would have been mitigated through the removal of admin rights_
> 
> _85% of Critical vulnerabilities in Microsoft Edge would have been mitigated through the removal of admin rights_
> 
> _100% of all Critical vulnerabilities in Microsoft Outlook products would have been mitigated by removing admin rights”_

It’s worth noting that these numbers have a double-edge. Microsoft products and services are the biggest in the market — over 1 billion people rely on Windows — making them obvious prime targets. At the same time, recognizing these exploits goes to show that the discovery and patching process is working exactly as it should. Shoring up the weakest link (users) seems to be a foundational pillar of Windows 11.

### Zero Trust

Up until now, Windows has largely operated on the Principle of Least Privilege (PoLP) when it comes to administrative access. Users are granted the least amount of access as is necessary for their job. For years, Microsoft encouraged users to shore up weaknesses in their security by actively using and maintaining admin rights. It’s fundamental to proper PoLP.

PoLP has been a foundation of computer security for decades. However, to work it needs constant care and vigilance from both software developers and users to be effective. Further, it makes the assumption that the platform (OS, firmware, hardware, storage, and network) upon which the application runs is itself secure. With the increasing value of data, threats to its security and increasing use of diverse computing resources, PoLP is proving insufficient to provide protection.

Zero Trust security is similar, but not exactly the same. The idea is to never trust anyone, anything, at any time. Or, [as Microsoft themselves say](https://www.microsoft.com/insidetrack/blog/microsofts-digital-security-team-answers-your-top-10-questions-on-zero-trust/ "www.microsoft.com"):

> _“Microsoft has adopted a modern approach to security called “Zero Trust,” which is based on the principle: never trust, always verify. This security approach protects our company and our customers by managing and granting access based on the continual verification of identities, devices and services.”_

But for various reasons, users mismanage or simply don’t bother with differentiating privileges, leaving entirely preventable gaps ready for exploitation. Like a parent enforcing stricter house rules for your own good, Microsoft has stepped in.

[Zero Trust policies](https://www.ncsc.gov.uk/collection/zero-trust-architecture/introduction-to-zero-trust "www.ncsc.gov.uk") are a new approach to secure system design that promise to deliver where PoLP cannot. In the simplest terms, it enables confidence and trustworthiness in a system to be established dynamically and continuously via a series of user and hardware verification (attestation) steps.

To execute Zero Trust verification and authentication, the platform must support a range of [Trusted Computing](https://en.wikipedia.org/wiki/Trusted_Computing "en.wikipedia.org") principles to enable a verifiably secure computing, storage and networking environment. Microsoft’s approach is to utilize the same protections used to securely separate hypervisor virtual machines along with a TPM device to provide a secure host for credential storage and operations.

As an aside, DRM implementers face a challenge; they have to embed the decryption key in all devices that can play the protected content. The most celebrated attack was probably the public disclosure of the DVD encryption key. Since then, they have been an early adopter of many Trusted Computing principles. For an example, see the [Protected Media Path](https://en.wikipedia.org/wiki/Protected_Media_Path "en.wikipedia.org"). Trusted Computing does raise a number of ethical issues, championed notably by the [EFF](https://www.eff.org/issues/trusted-computing "www.eff.org").

The hardware features for VBS have set the controversially high minimum hardware threshold for Windows 11. Limiting the CPU generation also eliminates a range of ‘side channel’ exploits.

To use MS nomenclature, Virtualization Based Security (VBS) provides a secure pathway in Windows 11 to implement some of the following:

*   “Kernel Data Protection” enables protection from rogue kernel mode software (drivers) from compromising the Windows kernel.
*   “Application Guard” utilizes VBS to isolate untrusted websites and documents and “Credential Guard” uses VBS to similarly secure access to credentials.
*   “Windows Hello Enhanced Sign-In” uses VBS to create secure pathways to external components like the camera and TPM when used for authentication.

These principles extend to Microsoft’s Azure ecosystem providing remote attestation features for cloud storage and computing resources.

Microsoft is clearly making an aggressive push to set the baseline for a secure computing platform. However, it remains to be seen how quickly the industry will upgrade both its hardware and the vast base of current applications and systems to utilize modern zero trust principles and services. In the meantime threat actors will continue to target the weakest link, whether that be legacy systems, legacy applications running on modern hardware, or social engineering techniques such as BEC.

It should also be noted that bugs in hardware protections will continue to be discovered and exploited, Meltdown and Spectre being two recent examples (more about that below); it is typically more difficult or impossible to patch such issues.

### From chip to cloud

In 2019, Microsoft announced Secured-core PCs as a proactive solution to growing firmware attacks, which are notoriously difficult to detect and remove.

> _“Secured-core PCs combine identity, virtualization, operating system, hardware and firmware protection to add another layer of security underneath the operating system. Unlike software-only security solutions, Secured-core PCs are designed to prevent these kinds of attacks rather than simply detecting them.” — [Windows Blog](https://www.microsoft.com/security/blog/2019/10/21/microsoft-and-partners-design-new-device-security-requirements-to-protect-against-targeted-firmware-attacks/ "www.microsoft.com")_

The concept of Zero Trust is now firmly rooted deep within the hardware of your PC, not just in the software that sits on top of it.

### Windows 11 hardware requirements

Given all the above, the [hardware requirements Windows 11](https://www.microsoft.com/en-gb/windows/windows-11-specifications "www.microsoft.com") demands make more sense. These demands mostly likely come in no small part because of [Meltdown and Spectre](https://meltdownattack.com/ "meltdownattack.com"), two computer processor security bugs discovered in 2018.

Patrick Moorhead, president and principal analyst at Moor Insights and Strategy spoke about it in a recent article in The Verge.

> _“Microsoft’s CPU selections for Windows 11 don’t appear much at all to do with performance but look like security mitigations for side-channel attacks.”_

The scale of these vulnerabilities honestly can’t be overstated — nearly every single device created over the span of decades was at risk. Even more, the problems were OS agnostic, but clearly Microsoft learned valuable lessons.

### Welcome to the real world

Sure, Microsoft is building upon an established foundation for future security steps, but it’s almost as though they’ve ignored conditions in the real world. Some of these were unforeseen, like the pandemic and subsequent supply chain issues, but they’re huge issues to contend with nonetheless.

*   Over [55% of enterprise workstations](https://www.lansweeper.com/itam/is-your-business-ready-for-windows-11/ "www.lansweeper.com") do not meet the requirements for automatic upgrades.
*   Manufacturers across all industries are experiencing a [global semiconductor shortage](https://www.bbc.co.uk/news/business-58230388 "www.bbc.co.uk").
*   [Millions of perfectly good](https://www.theverge.com/2021/6/29/22555371/microsoft-windows-11-cpu-support-hardware-requirements-tpm-response "www.theverge.com"), new(ish) PCs are suddenly “obsolete,” creating untold costs and waste.
*   The post-pandemic economy [has not completely recovered](https://www.brookings.edu/research/october-2021-update-to-tiger-the-global-economic-recovery-is-in-danger-of-stalling/ "www.brookings.edu"), and many firms are still keeping a close eye on their bottom line.

### Big leap? More like a small step

Given all these problems, it’s not surprising that Microsoft has stepped back slightly and announced that users can technically manually install Windows 11 on older PCs. As long as you have a 64-bit 1GHz processor with two or more cores, 4GB of RAM, and 64GB of storage — and you’re happy to do it — upgrading shouldn’t be a problem, even if you get some [scary warnings about possible “damage”](https://www.techradar.com/uk/news/windows-11-warning-mentions-possible-damage-to-unsupported-pcs "www.techradar.com") to unsupported systems. As it stands now, Microsoft will not offer updates or vital security patches to computers running Windows 11 that don’t meet the above CPU requirements.

 ![Windows 11 upgrade warning from The Verge.](https://strapistoragemacrium.blob.core.windows.net/strapi-uploads/uploads/20211013_what_do_we_know_about_windows_11s_security_fig_1_e06a8d4ccd.jpeg)

#### Windows 11 upgrade warning from [The Verge](https://www.theverge.com/2021/9/21/22686457/windows-11-health-check-compatible-supported-cpu-old-pc-waiver "www.theverge.com").

For the home and small business user who has a PC that ticks all the boxes, there is probably little practical security advantage in moving to Windows 11 at this time. The new features are either already available in Windows 10 (though not necessarily enabled by default or supported on all hardware) or only relevant in enterprise or highly secure environments. This stance may change if the Windows 11 enhanced kernel space protections prove resilient against a new class of exploit. The end of support date for Windows 10 may prove to be the biggest upgrade motivator for the security-conscious home and small business user.

What Microsoft is trying to achieve from a security perspective is commendable and certainly a move in the right direction. But considering the current issues of economic uncertainty, supply chain disruption, and the fact Windows 10 will be fully supported until 2025… it all sort of feels like much ado about nothing, for now.

20211013-what-do-we-know-about-windows-11s-security.jpeg

And more importantly, will it work? In previous posts we discussed how Macrium Reflect and Microsoft Windows 11 work together. In this article, we wanted to take a closer look at the new operating system itself, and what Microsoft’s choices indicate about their plans for what’s to come. But with many things, to get a clear picture of the future, one must briefly look at the past.

What do we know about Windows 11’s security strategy?

Your #1 resource for data backup, recovery, imaging and deployment insights and tips to help you develop your organisation's disaster recovery plan. | data-security

Cart

Macrium Software

Latest Blog Post

Latest Video

Need Help?