These incidents occur as security expert used to increasingly criticized Microsoft gives untimely And satisfactorily remedied defects in its products. As the largest technology supplier to the US government by far, Microsoft's vulnerabilities are to blame lion share of both newly discovered And most widely used software error. Many experts say Microsoft is refusing to make the cybersecurity improvements needed to keep up with growing challenges.
Microsoft has not “adjusted their security investments and thinking to match the threat,” said one prominent cyber policy expert. “It's a huge failure for someone with the resources and in-house technical capabilities like Microsoft.”
The Department of Homeland Security's CSRB endorsed this view in Its new report about the 2023 Chinese hack, saying that Microsoft demonstrated “a corporate culture that does not prioritize both investment in corporate security and rigorous risk management.” The report also criticized Microsoft for publishing inaccurate information about The reason may be about China's latest incursion.
According to many experts, recent breaches show that Microsoft has failed to implement basic security protections.
Adam Meyers, senior vice president of intelligence at security firm CrowdStrike, points to the Russians' ability to move from test environments to production environments. “That should never have happened,” he said. Another cyber expert working at a Microsoft competitor emphasized China's ability to snoop on the communications of multiple agencies through a single intrusion, echoing the CSRB report, which pointed to cites Microsoft's authentication system for allowing widespread access with a single login key.
“You just don't hear about these types of breaches from other cloud providers,” Meyers said.
According to the CSRB report, Microsoft “has not sufficiently prioritized restructuring its traditional infrastructure to address the current threat landscape.”
In response to written questions, Microsoft told WIRED that it is actively improving its security to address recent issues.
“We are committed to adapting to the evolving threat landscape and collaborating across industries and governments to fight back,” said Steve Faehl, chief technology officer of Microsoft's federal security business. these increasingly complex and growing global threats.”
Be part of it Secure Futures Initiative Launched in November, Microsoft improved its ability to automatically detect and block employee account abuse, Faehl said, starting to scan more types of sensitive information in network traffic, reducing Access is granted by personal authentication keys and creates new authorization requests for employees. looking to create a corporate account.
Faehl said Microsoft also redeployed “thousands of engineers” to improve its products and began convening senior executives for status updates at least twice per week.
Faehl said this new initiative represents Microsoft's “roadmap and commitment to meeting the majority of what the CSRB report calls priorities.” However, Microsoft does not accept that its security culture has broken down, as the CSRB report argues. “We strongly disagree with this characterization, although we agree that we are not perfect and have more work to do,” Faehl said.
Security revenue 'addicted'
Microsoft has received particular hostility from the cybersecurity community because Charge extra to your customers for better protections like threat monitoring, antivirus, and user access management. In January 2023, the company has offered that its security division has surpassed $20 billion in annual revenue.
“Microsoft has moved to view cybersecurity as something that generates revenue for them,” said Juan Andrés Guerrero-Saade, vice president of research at security company SentinelOne. His colleague Alex Stamos recently wrote that Microsoft is “addicted” this revenue “seriously distorted their product design decisions.”
