During this week’s Microsoft 365 outage, one airline warned that passengers using Microsoft email accounts might miss flight updates even though its flights were operating normally. At the same time, police forces in the UK asked people to phone in time-sensitive reports because some online forms weren’t getting through.
The airline needed to reach its passengers. The police needed the public to be able to reach them. A single provider’s outage disrupted communications in both directions. For anyone responsible for keeping a service running, that raises a question of control. You may know exactly where your email is stored, but if your usual inbox goes offline, what can your team do to get an urgent message through?
The first four questions below are worth working through with your IT team or email provider, whatever platform you use. They cover which messages need to keep moving, how to test a backup channel and who can act when an urgent security patch is released.
If you use Zimbra, the fifth question shows how to check which systems received the fixes in release 10.1.21.
Which messages would we need to keep moving?
Pick a real example, such as a customer reporting a fault through your website. Ask the person who normally handles it to show you where the report arrives. The website might record it in a case management system, or it might simply email a shared inbox. If it’s the latter, decide how someone would spot a report waiting for attention and how customers would know where else to reach you. For staff, agree where to report a problem if their usual mailbox is unavailable.
For a short staff discussion about reporting problems and alerting colleagues, use the Zimbra Email Security Checklist.
Could the people responsible reach each other without email?
Give two colleagues an ordinary task, such as approving a notice for customers, and ask them to do it using the agreed fallback. Can they find each other’s contact details without opening their inboxes? Can they sign in to the alternative channel if their usual sign-in service is unavailable? Run the exercise while everything is working. If it stalls, you’ve found something specific to fix.
Who acts when an urgent security patch is released?
Start with the last patch. Ask who saw the advisory, who checked whether it applied and who could approve the work outside the normal maintenance window. If a partner runs your email, ask them to show you the record for your service. It should tell you which systems received the fix, how they verified it and who followed up on anything outstanding. With Zimbra, we publish the advisory and the fix. The team operating the deployment is responsible for applying it.
Use the assessment in Vulnerability Monitoring and Patch Readiness to walk through that process together.
If our software is up to date, what else needs checking?
An update can fix a flaw in the software while leaving an old setting in place. Start with administrative access. Who still has it? Do those accounts require multi-factor authentication? Can the administration console be reached from networks that have no reason to use it? These are decisions your team can review even when there’s no new patch to install.
The white paper Securing a Zimbra Environment includes a checklist for reviewing access, configuration and services you no longer need.
What does that look like in a Zimbra release?
Zimbra 10.1.21 included fixes for self-service password recovery and how multi-factor authentication is enforced for WebDAV, a remote access service. If you run Zimbra, ask your administrator or hosting partner to show which version is deployed across your environment and when they last checked it. That gives you a concrete answer to take back to the people who rely on the service.
Watch the short 10.1.21 release video for an overview, or read the full release notes for the security changes.
No comments yet.