ABOUT AUTHOR

Youness EL Kandoussi is a seasoned Consultant Risk Expert with over 23 years of experience in Operational Risk Management, Islamic Finance, and Professional Training. He holds a certification as an Operational Risk Expert from the London School of Business & Finance (2018). Throughout his career, Youness has successfully led numerous large-scale projects for various banks, from conception to completion, ensuring their success in terms of costs and timelines. He has also been actively involved in conducting training programs on Risk Management for executives and employees of Financial Institutions, Public Administrations, Cooperatives, and Associations. Accomplishments Youness EL Kandoussi's notable accomplishments include: • Conducting successful certified training programs in Risk Management for professionals across different sectors. • Moderating and participating in various seminars and conferences within the financial industry and FinTech. • Implementing Operational Risk Management Systems and Risk Mapping for prominent institutions like SGMA, CDG Invest, and Umnia Bank. • Leading the implementation of Operational Risk Management Systems and Reporting projects, including functional specifications development and System implementation.

CATEGORIES
TAGS
READ ALSO
Should Microsoft Be Sued for Not Ensuring Business Continuity of Its Global Customers?

Context In the last few days, several businesses, including aviation and banking sectors, experienced significant disruptions due to issues with Microsoft services. This outage affected various cloud-based services, including Microsoft 365, Azure, and Teams. The interruptions were caused by a combination of network configuration changes and infrastructure issues within Microsoft's global network (https://www.reedsmith.com/en/perspectives/2024/02/business-interruption-claims-in-2024-a-global-perspective) (https://status.cloud.microsoft/#:~:text=URL%3A%20https%3A%2F%2Fstatus,100). The outage highlighted the increasing reliance of global industries on cloud services and the significant impact such disruptions can have on business operations, from communication breakdowns to halted transactions (https://www.businesswire.com/news/home/20240116375142/en/Allianz-Risk-Barometer-A-Cyber-Event-Is-the-Top-Global-Business-Risk-for-2024). While Microsoft worked to resolve the issues, it underscored the importance of robust cyber risk management and contingency planning in mitigating the effects of such outages (https://www.nortonrosefulbright.com/en/knowledge/publications/20530078/the-cyber-risks-faced-by-the-aviation-industry---ten-things-to-know). The recent Microsoft outages, which disrupted services like Microsoft 365, Teams, and Outlook, were primarily caused by a series of technical and security issues. Initially, Microsoft identified that a "wide-area networking (WAN) routing change" led to connectivity problems. This change triggered issues with network latency and timeouts, affecting how packets were forwarded across Microsoft's global network. This impacted users' ability to access various cloud services, including Azure, SharePoint, and OneDrive (https://www.bankinfosecurity.com/microsoft-365-cloud-service-outage-disrupts-users-worldwide-a-21017) (https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage). Additionally, Microsoft faced cyber risks, particularly distributed denial-of-service (DDoS) attacks. These attacks, launched by a group known as Storm-1359, aimed to disrupt services by overwhelming Microsoft's infrastructure with malicious traffic. The DDoS attacks targeted layer 7 of the OSI model, affecting HTTP(S) traffic and causing resource exhaustion and slowdowns (https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/). To mitigate these issues, Microsoft rolled back the problematic network changes and implemented additional protections to prevent similar disruptions in the future. These measures included enhancing their Web Application Firewall (WAF) and adding stricter controls on network command executions to avoid unintended consequences from network changes (https://www.bankinfosecurity.com/microsoft-experiences-second-major-cloud-outage-in-2-weeks-a-21134) (https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage). In recent days, significant disruptions in Microsoft services have caused major headaches for businesses worldwide. Industries ranging from aviation to banking found themselves grappling with unexpected downtime, impacting critical operations and highlighting a growing reliance on cloud-based services. This article explores whether Microsoft should be held legally accountable for failing to ensure business continuity for its global customers. The Outage and Its Impacts The recent Microsoft outages affected a range of cloud services, including Microsoft 365, Azure, and Teams. These disruptions were triggered by a combination of network configuration changes and infrastructure issues within Microsoft’s global network. Specifically, a "wide-area networking (WAN) routing change" led to severe connectivity problems. This change caused network latency and timeouts, disrupting the forwarding of data packets across Microsoft's global network. As a result, users experienced significant issues accessing cloud services such as Azure, SharePoint, and OneDrive. In addition to technical glitches, Microsoft also faced cyber threats, particularly distributed denial-of-service (DDoS) attacks. A group known as Storm-1359 targeted Microsoft’s infrastructure with malicious traffic, aiming to exhaust resources and slow down services. These attacks impacted layer 7 of the OSI model, affecting HTTP(S) traffic and causing further disruptions. The Importance of Business Continuity These outages underscore the critical role that cloud services play in modern business operations. From communication breakdowns to halted transactions, the ripple effects of such disruptions can be severe. The aviation and banking sectors, in particular, experienced significant operational impacts, illustrating the high stakes involved. As businesses increasingly rely on cloud services for their day-to-day operations, the importance of robust cyber risk management and contingency planning becomes more apparent. Legal and Ethical Considerations Given the scale and impact of these disruptions, the question arises: should Microsoft be sued for not ensuring business continuity? On one hand, businesses rely on service level agreements (SLAs) with cloud providers like Microsoft to guarantee a certain level of uptime and reliability. When these expectations are not met, it can lead to substantial financial losses and operational challenges. Businesses may argue that Microsoft failed to uphold its end of the agreement, warranting legal action to recover damages. On the other hand, the complexity of managing a global cloud infrastructure means that occasional outages are inevitable. Microsoft did take immediate steps to mitigate the issues, rolling back problematic network changes and enhancing protections against future disruptions. These efforts demonstrate a commitment to resolving the issues and improving service reliability. Cyber Risk Management and Contingency Planning The outages highlight the need for businesses to adopt comprehensive cyber risk management strategies and contingency plans. Relying solely on a single cloud provider can expose businesses to significant risks. Diversifying cloud services and implementing robust backup systems can help mitigate the impact of such outages. Additionally, regular testing and updating of contingency plans can ensure that businesses are better prepared to handle unexpected disruptions. Conclusion While the recent Microsoft outages have caused significant disruptions, suing the tech giant may not be the most effective solution. Instead, businesses should focus on enhancing their own cyber risk management and contingency planning efforts. By diversifying cloud services and implementing robust backup systems, businesses can better protect themselves against future outages. At the same time, cloud providers like Microsoft must continue to improve their infrastructure and security measures to minimize the risk of such disruptions and maintain customer trust. The recent events serve as a stark reminder of the interconnected nature of modern business operations and the importance of resilience in the face of unexpected challenges. References https://www.reedsmith.com/en/perspectives/2024/02/business-interruption-claims-in-2024-a-global-perspective https://status.cloud.microsoft/#:~:text=URL%3A%20https%3A%2F%2Fstatus,100). (https://www.businesswire.com/news/home/20240116375142/en/Allianz-Risk-Barometer-A-Cyber-Event-Is-the-Top-Global-Business-Risk-for-2024 https://www.nortonrosefulbright.com/en/knowledge/publications/20530078/the-cyber-risks-faced-by-the-aviation-industry---ten-things-to-know https://www.bankinfosecurity.com/microsoft-365-cloud-service-outage-disrupts-users-worldwide-a-21017 https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/

by Youness El Kandoussi | 3 months ago | 0 Comment(s) | 109 Share(s) | Tags :

Central Bank of Morocco and Operational Risk

The Central Bank of Morocco (Bank Al-Maghrib) is responsible for maintaining financial stability and ensuring the safety and soundness of the banking system in the country. As part of its role, the central bank sets regulations and guidelines for operational risk management in Moroccan banks. The Central Bank of Morocco has implemented a number of measures to manage operational risk in the banking sector. These include: Establishing regulations and guidelines for banks to establish their own operational risk management systems and processes. Conducting regular inspections and supervisory actions to ensure that banks are in compliance with these regulations and guidelines. Encouraging banks to implement international standards such as ISO 31000 for risk management and ISO 22301 for business continuity management. Encouraging banks to establish crisis management teams and emergency plans to respond to potential operational risks. In addition, the central bank also monitors and assesses the overall level of operational risk in the banking sector and takes action as necessary to mitigate potential threats to financial stability. Overall, the Central Bank of Morocco plays a key role in ensuring that Moroccan banks have robust operational risk management systems in place, which helps to protect the interests of depositors, shareholders, and the financial system as a whole.

by Youness El Kandoussi | 1 year ago | 0 Comment(s) | 398 Share(s) | Tags :

Targeted Selection with behavioral interviewing

Behavioral interviewing is a method of evaluating job candidates based on their past behavior and performance in specific situations. It involves asking candidates targeted questions about their previous experiences and the specific actions they took in order to assess their skills, knowledge, and suitability for the role.Behavioral interviewing is based on the belief that a person's past behavior is the best predictor of their future behavior. Therefore, by asking candidates about their past experiences and the actions they took in specific situations, it is possible to get a sense of how they are likely to behave in similar situations in the future.Behavioral questions typically begin with phrases such as "Tell me about a time when..." or "Describe a situation in which..." and require the candidate to provide a specific example of their past behavior. This can help to provide a more detailed and accurate assessment of the candidate's skills and abilities than more general questions about their qualifications and experience.Behavioral interviewing can be an effective tool for targeted selection because it allows the interviewer to focus on the specific skills and experiences that are relevant to the role. It can also help to identify candidates who are a good fit for the company's culture and values.

by Youness El Kandoussi | 1 year ago | 0 Comment(s) | 317 Share(s) | Tags :