Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be “more important even than the company’s work on artificial intelligence.”
Satya Nadella, Microsoft’s CEO, “has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security,” Smith told Congress.
His testimony comes after Microsoft admitted that it could have taken steps to prevent two aggressive nation-state cyberattacks from China and Russia.
According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the “security nightmare.” Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem, choosing profits over security, ProPublica reported.
This apparent negligence led to one of the largest cyberattacks in US history, and officials’ sensitive data was compromised due to Microsoft’s security failures. The China-linked hackers stole 60,000 US State Department emails, Reuters reported. And several federal agencies were hit, giving attackers access to sensitive government information, including data from the National Nuclear Security Administration and the National Institutes of Health, ProPublica reported. Even Microsoft itself was breached, with a Russian group accessing senior staff emails this year, including their “correspondence with government officials,” Reuters reported.
To reinforce the shift in company culture toward “empowering and rewarding every employee to find security issues, report them,” and “help fix them,” Smith said that Nadella sent an email out to all staff urging that security should always remain top of mind.
Yeah that ought to do it.
Lol. Considering it was senior management that ignored staff, this statement is even fucking dumber than it sounds.
That’s just barely thoughts-and-prayers level. They could at least schedule a mandatory meeting that interrupts everyone’s day for half an hour.
Usually they set up a hotline which may or may not get you fired.
Using the hotline won’t get you fired, but somehow - for totally unrelated reasons - after using it you’ll end up on a PIP with untenable goals, and that will get you fired.
This statement, from the company that looked at Recall and collectively said “yeah, this is a good idea”.
Well recall is why they’re so focused on security now. They want to host every detail of your life. They can’t do that now because their platform is a tire fire.
their platform is a tire fire.
Always has been
Pick one:
- security
- proprietary OS
you can have a propietary os thats secure, but the problem is once you get to the point where youre selling data and allow anything to be installed of course, its no longer secure.
You can’t verify it’s secure if it’s proprietary, so it’s never secure? Having control over other people’s computing creates bad incentives to gain at your user’s expense, so it’s day 1 you should lose trust.
You can have audits done on proprietary software. Just because the public can’t see it doesn’t mean nobody else can.
That just moves requiring trust from the 1st party to 2nd or 3rd party. Unreasonable trust.
Do you yourself actually audit the software you use, or do you just trust what others say?
Sure its secure, but is it verifiably secure?
I mean you can provide audit findings and results and it’s a pretty big part of vendor management and due diligence but at some point you have to accept risk in using open source software that can be susceptible to supply chain hacks, might be poorly maintained, etc or accept the risk of taking the closed source company’s documentation at face value (and that can also be poorly maintained and susceptible to supply chain attacks)
There’s got to be some level of risk tolerance to do business and open source doesn’t actually reduce risk. But it can at least reduce enshittification
It’s pretty hilarious when people act like being open source means it’s “more secure”. It can be, but it’s absolutely not guaranteed. The xz debacle comes to mind.
There are tons of bugs in open source software. Linux has had its fair share.
no they won’t. these pricks literally fired their entire AI Ethics team… that tells you everything you need to know about where their priorities are.
the only thing they are gonna do about this is figure out a way to make people not angry, but continue to fo as much shady shit as they can.
Definitely wasn’t aware of that…
literally fired their entire AI Ethics team
https://www.theverge.com/2023/3/13/23638823/microsoft-ethics-society-team-responsible-ai-layoffs
It’s always one of the first things to get cut when companies try to save money.
Well I know companies are willing to terminate employees for the sake of keeping up profits or preventing the loss of a company, no doubt. But the fact that they terminated an entire department - AI Ethics. Which I have to only assume is not a good idea when you’re implementing a new technology that can definitely go out of control.
deleted by creator
Microsoft focused on security at this point is like a builder focusing on building strong foundations now that the house is built on top.
It’s a little too late my dudes.
It would take ripping apart and rewriting hundreds of thousands of lines of source code, if not millions. Not just bloat from one off bright ideas, that led to the next bright ideas, but the deliberate obsfucation to protect proprietary code, in more instances than I can imagine. I’m not a programmer, so I could be wrong, obviously, but from my admittedly limited perspective, they’d be better off writing a whole new OS without all the built-in garbage nobody wants.
I think Windows 11 was supposed to be that clean break. They’ve reimplemented a lot of core functionality compared to XP & 7. If they’re still getting breached then they obviously aren’t serious about security.
The issues are primarily with Azure, I believe.
Seriously, why are governments using Microsoft software?
Don’t give me the nonsense line of “they need support”. There is support for Linux too, and Linux, sorry, works, is reliable and most importantly: a hell of a lot safer than windows. This is example #346269 where Microsoft not only fails to keep windows even remotely safe, but actively sabotaged their customers (in this case the US government) for their own profit.
And again, “wwheeeyyyrreee sooowwyyyy, pleeeaaasseeee forgif us?” Look! Look! Even our CEO will now be interested in secuwity!
Seriously I’m so tired of having to read this over and over and he government will just contoi to pump millions over millions into that piece of crap company.
Switch to Linux already and have computers that you can trust have no known issues that are not being resolved to cover for a few rich assholes!
