Yeah. Exchange in 365 is, in almost every scenario, the far better option than running it on-prem. No more worries about installing the latest CU before attackers get in.

The only scenario where on-prem makes sense is a totally offline environment.

Shift some of the burden of responsibility to a third party. Organizations love this shit This is the only valid suggestion I've seen. And I get it - I just think there's probably better third parties. Microsoft has some of the best paid security analysts and engineers in the industry. Chances are they’d be able to detect and mitigate attacks attacks better than a small local team of not highly paid sysadmins.

I hear this a lot about cloud companies, but see little evidence of it. People post frequently about leaving big cloud companies because of all sorts of reasons, one of which might well be pay. But even if they did have some of the best paid people - they're not all highly paid people, and I doubt operations support are those people. (Have you ever tried to talk to Microsoft support?)

As I remember and understood it (I'm not doing a deep dive to refresh my memory for a lemmy post, but the overall point I think stands) the recent hack of Microsoft was because of accepting a home end user certificate to authenticate to a business / corporate (and apparently government) accounts. From what has been released, this happened due to a mix of (IMO) questionable design and lack of documentation or knowledge of how the authentication flows worked. These security engineers should have caught this before it landed in operations - because you have to catch these things in design, not rely on everyone using an authentication framework to sort of "cover for accepting multiple trust centers" that should not overlap. The reason this is a design issue is actually because it seems like it came about because of a new feature or function that wanted to allow lower confidence credentials to migrate to higher confidence or something like that.

If the security engineers missed that - they're not that great. If they were overruled by management, well, that's actually likely, but doesn't change the facts that you as a subscriber didn't OK that (frankly crazy) design change - you weren't even informed. This is always an issue with the Cloud services, and I don't see a way around it. Even people with contractual agreements got screwed here.

Microsoft is large enough to get some assistance from 3 letter agencies. That’s almost never going to happen with smaller companies.

I don't see how that actually helps though. Most of our 3 letter agencies provide public guidance about defensive security recommendations and have for over a decade. There's plenty of consultants if you can't hire internally that can guide you through that stuff. The TLAs are not magical - I guess they might tell you you've been hacked or may tell you they know you've been targetted - but honestly - OF COURSE Microsoft Azure is a target, and we know it's been hacked. This hack wasn't revealed by a TLA, or by the "super duper security analysts" - it was a customer going over logs (that are so in the weeds most people didn't pay for access to these logs at all) who informed Microsoft.

And this is my main counterpoint - when you have a "Fort Knox" you need really really good guards and can never make a mistake. I'm not sure it's possible to have sufficient defenses when you're running the e-mail for most businesses and the US government. We need to stop just assuming the Cloud providers have better {insert thing here} because of scale or money. I'd argue it's pretty obvious they don't - because they make more money if they don't have the top end employees and can sell more features if they don't lock stuff down and actually test before release. I'm going to argue that there's every reason to believe that most Microsoft employees or contractors doing all functions are more like their support people than some better than you can hire super IT person.