10 ms·
Microsoft ties executive pay to security after multiple failures and breaches
- ripvanwinkle 2y agoabout time. you also need a clawback provision since it can take a while for flaws to be detected and the execs could be in new jobs by then.
- stoperaticless 2y agoA bit curious how is it worded. I wonder, will it actually improve security, or will it be metrics that are being played around actually decreasing security (e.g. Teams might stop registering/tracking issues as a way of not having registered bugs)
- thegrim33 2y agoPretty much the definition of https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law
- fuzztester 2y agoWow, the first two things I thought of after reading the first few lines of that article were: - the Peter Principle (as a loosely related concept) and - that the new MS diktats would immediately be gamed. What was my surprise when I saw both those concepts mentioned in the See Also section! I did not know about most of the other See Also points, though, except for Confirmation bias, which I had read about on Hacker News, and the Hawthorne Effect, which I had read about elsewhere, IIRC, in a Dale Carnegie or similar self-help book.
- fsflover 2y agoRelated recent discussion: https://news.ycombinator.com/item?id=40228212 https://news.ycombinator.com/item?id=40228212
- dinvlad 2y agoFunny how I've heard from an Azure employee who worked with many big clients that very few among them cared about security - the incentives were just not there. Seems like they're finally doing something about that, to set an example for the rest of the industry.
- magicalhippo 2y agoWe're getting drowned by security checklist by clients now. A lot of them don't make much sense for us, we primarily make a Win32 B2B program hosted by these customers themselves and a lot of the checklists are all about more generic web SaaS things (because we charge like SaaS). But the person on the other end wants all the questions answered regardless. Seems that as long as you can put a checkmark in a box that you follow various "best practices" and whatnot, actual details don't matter. You put a checkmark in a box, you did your best.
- Atotalnoob 2y agoThis is basically what I have experienced. My current place, there are developers still using like node 10 and other ancient software, but god forbid you not fill out a checklist.
- kstrauser 2y agoFrom being on the buying side, it's likely that the person sending you that questionnaire knows a lot of it is irrelevant to your situation, but they're personally reviewing 100 vendors this year (no, seriously) and there aren't enough hours in the week for them to make exceptions for everyone. Very often the best answer would be like: > Q: Do you use multi-tenant databases? > A: N/A: you'll be deploying our product on your own server. That's actually a perfectly fine answer! The person reading it doesn't have to explain large gaps in the answers to their boss. It documents why this isn't relevant in a way their successor can easily understand next year when they're reviewing those 100 vendors as part of their annual Vendor Management Policy™ process.
- Terr_ 2y ago
- wrs 2y agoI had heard the previous overriding directive was “DO AI” so now am wondering how that combines with “DO SECURITY”.
- Nasrudith 2y agoThey are antithetical really. AI is fundamentally about undefined behavior because we cannot define it better algorithmically (putting aside the AI algorithms themselves). Security is about avoiding such undefined behavior and only doing things that we expect. At best you have a very secured sandbox to keep the AI in, away from anything but user input and training data.
- ChrisArchitect 2y agoActual article: https://www.microsoft.com/en-us/security/blog/2024/05/03/security-above-all-else-expanding-microsofts-secure-future-initiative/ https://www.microsoft.com/en-us/security/blog/2024/05/03/sec... (https://news.ycombinator.com/item?id=40249290 https://news.ycombinator.com/item?id=40249290)
- OnionBlender 2y agoThe Ars Technica article is a lot more critical of Microsoft and provides some history. That said, it is frustrating how most of the links just link to other Ars articles.
- warkdarrior 2y agoEverybody is copying the Wikipedia model, trying very hard to keep you on their website.
- dylan604 2y agoWhen it comes to Wiki, I don't mind that though. The links in the footnotes are there if you want to see the external sources.
- 0xDEFACED 2y agoWhen I click on link in an article, almost always it’s because I want to cross reference the information on a different source. If the link takes me to another article on the same site, I usually stop reading altogether. Wikipedia is an exception, of course.
- zarathustreal 2y agoWhy would Wikipedia be an exception?
- yesco 2y agoWikipedia offers it's external links via citations
- tithe 2y ago"...its Senior Leadership Team's pay partially dependent on whether the company is "meeting our security plans and milestones," though Bell didn't specify how much executive pay would be dependent on meeting those security goals." What's the percentage? What are the milestones? Edit: The "security plans and milestones" appear to be here: https://www.microsoft.com/en-us/security/blog/2024/05/03/security-above-all-else-expanding-microsofts-secure-future-initiative/ https://www.microsoft.com/en-us/security/blog/2024/05/03/sec...
- tracerbulletx 2y agoFor sure will result mostly in hiding and not admitting things.
- nicce 2y agoYep. If someone's salary depends on the amount of the public disclosures, there will be less disclosures and less transparency.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- Crontab 2y agoMS might not be providing security but at least they are giving us the Copilot key and in-Windows advertising.
- GreedIsGood 2y agoCharlie has been at MSFT a little while now, I suspect he knows how the machine works. I would expect this to result in lower feature velocity. In theory features are tied to increasing revenue. If so, I wonder if he is actually willing to make that trade off.
- jauntywundrkind 2y agoThis is like the Samsung managers that have to work 6 days a week. What a drain on morale. Software in particular has been so lucky to have so many people able to steam ahead, break ground, make features and new products. This caring for the rest, looking at longer lifecycle & maintaining... It's not fun. It's not inspirational. It's not fast. It doesn't feel productive or creative. And that's some of the next decades for this profession. An end to fun and innovation. More being yolked and driven by external demands & stressors. Good luck all.
- PedroBatista 2y agoUnfortunately most of the "hard" work will be metrics massaging, redefining words and covering stuff. But the first phase will be a lot of "security & quality" presentations to the troops, some hiring and ground prep-work so the blaming can be done when things go south. I would like to be more positive, but I already saw this cycle too many times. How about security being part of the requirements to keep a job instead of monetary bonus? and this has to be applied to the top, only then to the bottom.
- itsoktocry 2y ago>How about security being part of the requirements to keep a job instead of monetary bonus? Because the monetary incentives are greater than the position for executives, and they are the ones to be accountable. Of course this is a form of lip service. Of course there's way more to do. But they are making a very public statement to prioritize security. That's a positive.
- fragmede 2y agoIf the person was notified of a security problem, and ignored it, or tried to sweep it under the rug, instead of taking it seriously, then absolutely fire them, but assuming no malfeasance, firing people just leads to institutional knowledge loss which would lead to worse outcomes.
- PedroBatista 2y agoI was talking about executives and high ranking managers, not devs. Firing someone for a bug or honest mistake would be ridiculous.
- fragmede 2y agoExecutives and high ranking managers might not be people to you, but they also have invaluable institutional knowledge that will lost if they get fired.
- 2y ago
- userbinator 2y agoMore excuses to justify increasing authoritarianism. I don't think this will have any positive effect.
- ein0p 2y agoFun fact: for many years now executive (and manager) pay at Microsoft has been tied to meeting diversity quotas, and hiring straight white men when you’re under quota required exec approval: https://www.cspicenter.com/p/what-diversity-and-inclusion-means https://www.cspicenter.com/p/what-diversity-and-inclusion-me.... How this particular new “tying” of one thing to another impacts the overall state of things is anyone’s guess.
- lcvw 2y agoThat seems highly illegal. I’m not sure I believe that.
- mikestew 2y agoYou don’t have to believe, I read the whole goddamned linked “article”, and parent misrepresented even that. There was a VP that approved promotions, but no particular requirement just for straight white males. That’s just one example of parent’s BS. They got other stuff from the link wrong, too.
- ein0p 2y agoStraight white males are the only “non-diverse” demographic. So they aren’t mentioned specifically in diversity quotas, of course. But if you hire too many of them, you can kiss some part of your bonus goodbye on account of not meeting quotas. How this is legal IDK
- eddythompson80 2y ago> But if you hire too many of them, you can kiss some part of your bonus goodbye on account of not meeting quotas. How this is legal IDK Because you’re literally pulling that out of your ass. Even the article you link never mentions that and mentions multiple times that there was no such thing.
- ein0p 2y ago
- cjk2 2y agoPerhaps they should tie executive pay to customer satisfaction? Security is somewhere under that umbrella. Also all the other stuff end users give a shit about that Microsoft doesn't...
- weikju 2y agocynically... the customers are very satisfied. The end users not so much.
- Angostura 2y agoGood security can be quite annoying to end users, so be careful with that metric
- andrewstuart 2y ago>> customer satisfaction "How did we do?" "Please take a few minutes to fill out this survey on your recent interaction with Microsoft"
- gerdesj 2y ago"Perhaps they should tie executive pay to customer satisfaction?" MS is a publicly quoted company wot sells shares. They are therefore answerable to their shareholders. Shareholders first, everyone else comes second is largely the first order of the day. It's a bit shit when you try to factor in some sort of moral angle but that is how things are.
- rlupi 2y agoI think what regulators should start doing instead or on top of of inflicting monetary fines is to force companies to mint a significant amount of new shares and put them in escrow accounts, then in case some future event happen (security incident meeting some specific criteria for a catastrophic incident), the share should be put on sale at market price and used to refund the affected customers and pay for the regulatory costs. In this way, executives and policy makers have a harder time moving on and not being accounting before the effect of their bad decisions is apparent, because the reputation for sharesholder value destruction could haunt them. Executives will be incentivized to create a better security culture.
- gigel82 2y ago"Secure by default: Security protections are enabled and enforced by default, require no extra effort, and are not optional.". Let me guess: logging in with a Microsoft Account is a security protection, as is collecting more telemetry, for security of course.
- exitzer0 2y agoIf anyone is dumb enough to trust Microsoft after all the shit they've pulled over the last 30+ years, including the most recent collection of large-scale security fuckups, they deserve what they get.
- m463 2y agoI don't know if this is play to win or play to not lose.
- deleted 2y ago[deleted]
- rawgabbit 2y agoI wonder why is Microsoft doing this now? They had blithely ignored security for many years. Their products have been insecure by default as long as I can remember.
- minisoftmicro 2y agoNice. Looking forward to more of those security training and unskippable tests every few months.
- WhyNotHugo 2y agoSo they're providing financial incentives to executives who don't disclose breaches in security? This is terrible.
- MaxBarraclough 2y agoI suppose it all hinges on whether Microsoft takes a hard line against executives failing to honestly disclose security incidents. Ideally they'd treat it as a form of fraud.
- fennecbutt 2y agoHow about just fire them with no golden handshake if they don't do a good job, just like any other employee.