SolarWinds Hack pits Microsoft against Dell and IBM over how companies store data

For the past two months, government and industry cybersecurity experts have been trying to unveil details of the incident that is leading to a reassessment of the long-term network security hypotheses. The hackers, according to investigators, accessed through the networking company SolarWinds Corp. and other avenues of attack.

At a House committee meeting on the hack on Friday, Microsoft President Brad Smith said in prepared statements that “cloud migration is critical to improving the maturity of security in many organizations.” All of the attacks the company has identified involved local systems, he said earlier.

The debate is part of the aftermath of the alleged Russian-led attack, which Senate Intelligence Committee Chairman Sen. Mark Warner (D., Va.) Said Tuesday could be of range and scale “Beyond any we have faced as a nation.”

Microsoft, one of the world’s largest cloud providers, has said that cloud services offer customers the most robust data protection. A mixed approach “creates an additional cost that organizations have to guarantee. One consequence of this decision is that if the local environment is compromised, this creates opportunities for attackers to target cloud services, ”Microsoft said in a blog post about its hack investigation.

The idea that the hybrid cloud is less secure is inaccurate, said Paul Cormier, chief executive of Red Hat, the business IBM acquired two years ago, in part, in a bid for growing demand for hybrid cloud services. “Any software could be split. Cloud providers could also break down, ”he said.

Companies traditionally invested in large servers to store much of the data of their products and customers. That changed about a decade ago, with the rise of cloud computing. Amazon.com Inc.

AMZN 1.17%

and Microsoft popularized the business model where they provide remote hardware and software based on payment, eliminating the need for companies to buy and maintain expensive equipment. The cloud business has been one of the main profit engines of both.

There is no indication that Amazon’s systems were directly breached, but hackers used their cloud computing data centers to launch a key part of the attack, security researchers have reported. Senators expressed their irritation that Amazon did not participate in a Senate hearing on the hack. Amazon said it was “not affected by the SolarWinds problem” and had shared with law enforcement what it knew and had informed government officials and lawmakers.

One of the biggest security concerns around cloud computing is the fear that a service provider’s commitment could cause access to their data to a wide range of customers, cybersecurity experts have said.

It’s not practical to wait for customers to move all their data to the cloud, Cormier of Red Hat said. Many companies, especially in the financial industry, are required to store data locally for security reasons or regulations, he said.

Many customers find data retention at home safer, said Keith White, a former Microsoft Cloud executive and senior vice president of hybrid cloud services at Hewlett Packard Enterprise. Co.

HPE 0.48%

HPE did not find any of its customers exposed to SolarWinds attacks, he said in an interview.

“One of the key reasons to keep things on premise is because the customer wants to know where their data is,” White said.

Asking questions about hybrid cloud security “serves Microsoft’s broader narrative,” Deepak Patil, senior vice president of cloud technology at Dell Technologies and a former Microsoft cloud executive, told the newspaper. “But the reality is, look at most customers, their workloads are running prematurely.” Dell sells hardware and software to manage hybrid cloud systems.

Microsoft said in a statement that “we offer security options for both cloud and on-premises deployment,” but added that built-in cloud protection requires more effort to deliver to on-premises servers.

Speaking at Friday’s hearing, Mr. Smith of Microsoft said that “when services are attacked in Microsoft’s cloud, we can detect anomalies and compromise indicators in ways that are not possible in a local environment.” The company also could not hunt down Russian hackers on local networks, he said.

The SolarWinds attack affected at least nine federal agencies and 100 private companies and dates back to at least September 2019. U.S. authorities say the intruders are likely Russian intelligence agents. Moscow has denied its responsibility.

Microsoft was the victim of the attack and had part of its source code downloaded to write the software. Hackers saw software linked to Microsoft’s Azure cloud, the company said. Smith, at the Senate hearing on the hack on Tuesday, called for a “full examination of what other cloud services and networks the Russians have had access to.”

Historically, Microsoft has had a big local business with its Windows operating system with servers. But under the general direction of Satya Nadella, the software plant has aggressively pushed its customers towards its products in the cloud. It still offers products that make it easier for customers to use their data centers.

–For more analysis, reviews, tips, and WSJ technology headlines, sign up for our weekly newsletter.

—Robert McMillan contributed to this article.

Write to Aaron Tilley to [email protected]