4 ms·

The nice thing about priorities is there can be so many of them, no need to really choose. I'm sure there are plenty of people at Microsoft who are saying, "rig

The nice thing about priorities is there can be so many of them, no need to really choose. I'm sure there are plenty of people at Microsoft who are saying, "right, security is their top priority, but mine is {profit, compatibility, promotion, market share, hobbling open source, promoting open source, offloading liability}.

nindalf 2y ago
This is usually true, but the CEO is very clear here - when faced with a choice between security and something else, every employee must choose security. And to head off the possibility that some exec chooses differently, a portion of each exec’s compensation is tied to the security initiative. It’s always difficult to change the direction of a company this size (or even 10 times smaller), but it appears as if Satya has done a reasonable job aligning people’s incentives. They may still fail, or not make enough progress in a reasonable timeframe, but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do.
- HenryBemis 2y ago
  > usually true, but the CEO is very clear here - when faced with a choice between security and something else the challenge is "how can you prove that this risk will materialize and will cause $3 damage - while the pill costs $5 - and what will the shareholders do". I've been in Audit/GRC/Security for enough years to have had enough 'fights' on risk management. With very few exceptions, the money defines the risk and not the other way around. If history has taught us anything, it will be IT-Sec-trainwrecks-all-the-way-down. > but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do no disrespect to a/this CEO.. but he is 'just' an employee. And he can always tell different things to the Townhalls and the Press/Media, but pull a U-turn. All he has to do is reduce the budget of X-dept, reduce the headcount/org-chart of Y-dept, and while the intentions are great, the effort is not supports (I've made one more comment on this thread about staffing initiatives somewhere higher/lower in this article's comments)
  - wepple 2y ago
    I’m fairly skeptical too, and only time will tell. FWIW I don’t think highly of Microsoft when it comes to security. But two things that may be positive: 1) there is precedent for Microsoft doing a strong 180 when it comes to security, driven by the original trustworthy computing memo of 2002. We’ll see if Satya means this level or not 2) it looks like they’re being hurt by the most important motivator of all: money. If they don’t tidy up their act fast, govt and industry will come down hard on them. The US is losing the cyber persistence game to China and it’s a national security risk Edit: precedent/president
jeffrallen 2y ago
Funny story about priorities. My boss once gave me two top priorities. I told her, "there can be only one". She resisted a bit, but luckily these two projects literally required sacks of cement to be brought from hundreds of kilometers away by truck (context: humanitarian aid). I said, "if only enough cement arrives for one of them on the next truck, which one gets it?" It was at that moment she understood why there can be only one top priority. She was a good boss, and learned a lot from working with a hard-headed engineer.

nindalf 2y ago

This is usually true, but the CEO is very clear here - when faced with a choice between security and something else, every employee must choose security. And to head off the possibility that some exec chooses differently, a portion of each exec’s compensation is tied to the security initiative. It’s always difficult to change the direction of a company this size (or even 10 times smaller), but it appears as if Satya has done a reasonable job aligning people’s incentives. They may still fail, or not make enough progress in a reasonable timeframe, but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do.

HenryBemis 2y ago
> usually true, but the CEO is very clear here - when faced with a choice between security and something else the challenge is "how can you prove that this risk will materialize and will cause $3 damage - while the pill costs $5 - and what will the shareholders do". I've been in Audit/GRC/Security for enough years to have had enough 'fights' on risk management. With very few exceptions, the money defines the risk and not the other way around. If history has taught us anything, it will be IT-Sec-trainwrecks-all-the-way-down. > but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do no disrespect to a/this CEO.. but he is 'just' an employee. And he can always tell different things to the Townhalls and the Press/Media, but pull a U-turn. All he has to do is reduce the budget of X-dept, reduce the headcount/org-chart of Y-dept, and while the intentions are great, the effort is not supports (I've made one more comment on this thread about staffing initiatives somewhere higher/lower in this article's comments)
- wepple 2y ago
  I’m fairly skeptical too, and only time will tell. FWIW I don’t think highly of Microsoft when it comes to security. But two things that may be positive: 1) there is precedent for Microsoft doing a strong 180 when it comes to security, driven by the original trustworthy computing memo of 2002. We’ll see if Satya means this level or not 2) it looks like they’re being hurt by the most important motivator of all: money. If they don’t tidy up their act fast, govt and industry will come down hard on them. The US is losing the cyber persistence game to China and it’s a national security risk Edit: precedent/president

jeffrallen 2y ago

Funny story about priorities. My boss once gave me two top priorities. I told her, "there can be only one". She resisted a bit, but luckily these two projects literally required sacks of cement to be brought from hundreds of kilometers away by truck (context: humanitarian aid). I said, "if only enough cement arrives for one of them on the next truck, which one gets it?" It was at that moment she understood why there can be only one top priority. She was a good boss, and learned a lot from working with a hard-headed engineer.