13 ms·

> They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. That is what a support team is f

> They can literally just give themselves permission and roll in. If you can't your just not high enough up in a support team. That is what a support team is for. And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. This isn't some super duper secret, when shit breaks there needs to be a, well secured, escape hatch for the people who fix things to crawl in and make repairs. Prior to cloud hosting, Microsoft could get permissions to remote in to your servers, or prior to those days, send someone physically out with a laptop and a debugger.

JohnFen 3y ago
> And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. But surely you can see that saying this is still the same as just saying "trust us". It's very, very hard to trust Microsoft.
- com2kid 3y ago
  Not having those protections in place would be a company ending event for Microsoft. The legal system would crush them, and customers would leave in droves. And the number of markets Microsoft completes in now is tiny. This isn't the 90s where Microsoft competed in slews of consumer and business markets. The potential upside from the Cloud team slurping up secrets from competitors in literally ANY other business segment, is dwarfed by the losses that would hit MS. Now of course that doesn't mean some corrupt fool in sales won't risk destroying the company so he can make his yearly bonus (that very thing has brought down companies before!), but Microsoft internally has a lot of motivations to ensure that doesn't happen. So, don't trust Microsoft saying "trust us". Trust Microsoft being greedy and wanting to keep growing the cash cow that is Azure Cloud.
  - JohnFen 3y ago
    I wasn't talking about Azure. I was talking about Microsoft's software products such as Outlook, Windows, etc. Rergardless, my point is that Microsoft saying that they have audits and controls in place is exactly the same as them saying "trust us". They're just saying "trust that we have effective controls in place".
    - sabarn01 3y ago
      What exactly can an org do. We hire outside verifiers and then meet their standards.
      - JohnFen 3y ago
        Sure, I understand. The thing is that a company has to already have a measure of trust in order for the verification to be of reassurance to people. Hiring outside verifiers is absolutely better than nothing, but it's not a thing that inherently instills a high degree of confidence. What an organization can (and should) do is to behave in a way that earns people's trust over time. Microsoft actually had a window of opportunity to do this. They even made a very public campaign proclaiming how they weren't like the Microsoft of old and were more trustworthy than they used to be. And for a while, I even thought that perhaps a real culture change really did happen. But their behavior (especially around Windows and Office) is uncannily similar to that of other companies of questionable trustworthiness.
        jryle70 3y ago
        Suppose I'm using services provided by JohnFen's employer. What does it do better than Microsoft that I can trust it with my data? What should Microsoft do to be a trusted partner?
- trympet 3y ago
  You don't have to take their word for it. See the SOC audit reports for yourself: https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d4-48cc-a9fe-302055a661d4 https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d...
  - JohnFen 3y ago
    That document doesn't seem to want to load for me, so I can't really comment on it one way or another.
    - trympet 3y ago
      https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-1#office-365-audit-reports https://learn.microsoft.com/en-us/compliance/regulatory/offe... https://servicetrust.microsoft.com/ViewPage/AllDocuments https://servicetrust.microsoft.com/ViewPage/AllDocuments
      - JohnFen 3y ago
        I got to the PDF download link, but I have to have a Microsoft account to actually download it, so that's a bit of a showstopper. In any case, it doesn't much matter. The threads I'm in here are pretty much just me saying I don't trust Microsoft and others saying that I should, so I'll just bow out and leave it at that: we have different opinions.
- phillipcarter 3y ago
  > It's very, very hard to trust Microsoft. The utterly massive enterprise market that values security and privacy and also pays Microsoft oodles of money says otherwise.
  - JohnFen 3y ago
    Well, I think most enterprises are more concerned with liability than anything, and as long as they can blame any breaches/security issues on Microsoft, that addresses most of their concern. Also, people aren't enterprises. Microsoft doesn't treat people like they treat enterprises.
  - advael 3y ago
    If you don't know that millions of people spending money can't be fools, you're probably one of them And frankly given the monopolistic nature of the business, there are a lot of enterprises that pay for microsoft's services because they don't have the power to make the decision not to
  - wolverine876 3y ago
    Enterprises have more leverage and different agreements, often custom agreements, with vendors. Small businesses and consumers get click-wrap agreements - nobody reads them; nobody has time and Microsoft wouldn't change them regardless.
gtvwill 3y ago
Oh I don't treat it like a secret. It's more that it's not known or understood by many users in how it actually affects the security posture of your organization. It's one of those commonly overlooked things.

JohnFen 3y ago

> And those access elevations will be tracked and audited, just like at any other organization that handles sensitive data. But surely you can see that saying this is still the same as just saying "trust us". It's very, very hard to trust Microsoft.

com2kid 3y ago
Not having those protections in place would be a company ending event for Microsoft. The legal system would crush them, and customers would leave in droves. And the number of markets Microsoft completes in now is tiny. This isn't the 90s where Microsoft competed in slews of consumer and business markets. The potential upside from the Cloud team slurping up secrets from competitors in literally ANY other business segment, is dwarfed by the losses that would hit MS. Now of course that doesn't mean some corrupt fool in sales won't risk destroying the company so he can make his yearly bonus (that very thing has brought down companies before!), but Microsoft internally has a lot of motivations to ensure that doesn't happen. So, don't trust Microsoft saying "trust us". Trust Microsoft being greedy and wanting to keep growing the cash cow that is Azure Cloud.
- JohnFen 3y ago
  I wasn't talking about Azure. I was talking about Microsoft's software products such as Outlook, Windows, etc. Rergardless, my point is that Microsoft saying that they have audits and controls in place is exactly the same as them saying "trust us". They're just saying "trust that we have effective controls in place".
  - sabarn01 3y ago
    What exactly can an org do. We hire outside verifiers and then meet their standards.
    - JohnFen 3y ago
      Sure, I understand. The thing is that a company has to already have a measure of trust in order for the verification to be of reassurance to people. Hiring outside verifiers is absolutely better than nothing, but it's not a thing that inherently instills a high degree of confidence. What an organization can (and should) do is to behave in a way that earns people's trust over time. Microsoft actually had a window of opportunity to do this. They even made a very public campaign proclaiming how they weren't like the Microsoft of old and were more trustworthy than they used to be. And for a while, I even thought that perhaps a real culture change really did happen. But their behavior (especially around Windows and Office) is uncannily similar to that of other companies of questionable trustworthiness.
      - jryle70 3y ago
        Suppose I'm using services provided by JohnFen's employer. What does it do better than Microsoft that I can trust it with my data? What should Microsoft do to be a trusted partner?
trympet 3y ago
You don't have to take their word for it. See the SOC audit reports for yourself: https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d4-48cc-a9fe-302055a661d4 https://servicetrust.microsoft.com/DocumentPage/6ee23fc7-20d...
- JohnFen 3y ago
  That document doesn't seem to want to load for me, so I can't really comment on it one way or another.
  - trympet 3y ago
    https://learn.microsoft.com/en-us/compliance/regulatory/offering-soc-1#office-365-audit-reports https://learn.microsoft.com/en-us/compliance/regulatory/offe... https://servicetrust.microsoft.com/ViewPage/AllDocuments https://servicetrust.microsoft.com/ViewPage/AllDocuments
    - JohnFen 3y ago
      I got to the PDF download link, but I have to have a Microsoft account to actually download it, so that's a bit of a showstopper. In any case, it doesn't much matter. The threads I'm in here are pretty much just me saying I don't trust Microsoft and others saying that I should, so I'll just bow out and leave it at that: we have different opinions.
phillipcarter 3y ago
> It's very, very hard to trust Microsoft. The utterly massive enterprise market that values security and privacy and also pays Microsoft oodles of money says otherwise.
- JohnFen 3y ago
  Well, I think most enterprises are more concerned with liability than anything, and as long as they can blame any breaches/security issues on Microsoft, that addresses most of their concern. Also, people aren't enterprises. Microsoft doesn't treat people like they treat enterprises.
- advael 3y ago
  If you don't know that millions of people spending money can't be fools, you're probably one of them And frankly given the monopolistic nature of the business, there are a lot of enterprises that pay for microsoft's services because they don't have the power to make the decision not to
- wolverine876 3y ago
  Enterprises have more leverage and different agreements, often custom agreements, with vendors. Small businesses and consumers get click-wrap agreements - nobody reads them; nobody has time and Microsoft wouldn't change them regardless.

gtvwill 3y ago

Oh I don't treat it like a secret. It's more that it's not known or understood by many users in how it actually affects the security posture of your organization. It's one of those commonly overlooked things.