4 ms·

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

danpalmer 2y ago
I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture.
- outworlder 2y ago
  It's hit and miss. They have one of the largest cyber security operations worldwide and regularly track and dismantle criminal operations. There's some great people working there. Then there's Azure. Which is used by large organizations and you would expect it to have the utmost care when it comes to security. But it often does badly, in several instances it allowed different tenants to access information from one another, something unheard of on AWS. For example: https://www.securityweek.com/microsoft-patches-azure-cross-tenant-data-access-flaw/ https://www.securityweek.com/microsoft-patches-azure-cross-t... or https://www.theregister.com/2024/06/05/tenable_azure_flaw/ https://www.theregister.com/2024/06/05/tenable_azure_flaw/ or https://borncity.com/win/2023/08/03/microsoft-as-a-security-risk-azure-vulnerability-unpatched-since-march-2023-heavy-criticism-from-tenable-part-2/ https://borncity.com/win/2023/08/03/microsoft-as-a-security-... There are so many cross tenant vulnerabilities that there could be some overlap in those URLs, and it's a bit late at night for me to read those carefully, but you get the idea. They do get the most flak about Windows, which used to be a non networked, single user OS.
- cassianoleal 2y ago
  > Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture. If the whole value is in ticking the box, why would that develop a culture that values anything more than the tick?
  - antonvs 2y ago
    The cycle usually goes something like box ticking, complacency, security scare, remediation, rinse and repeat.
- justinclift 2y ago
  > but this surprises me Unfortunately, it's true. People used to relying on Microsoft understandably don't want it to be so, so they're in for a rough time trying to figure out actually workable alternatives. :( This has been an ongoing problem for years, and every time some new problem is found Microsoft just trots out the PR promises that they'll do better. Without then doing any better. • https://arstechnica.com/information-technology/2022/10/how-a-microsoft-blunder-opened-millions-of-pcs-to-potent-malware-attacks/ https://arstechnica.com/information-technology/2022/10/how-a... (2022) • https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec... (2023) • https://arstechnica.com/information-technology/2024/04/microsoft-blamed-for-a-cascade-of-security-failures-in-exchange-breach-report/ https://arstechnica.com/information-technology/2024/04/micro... (2024) For the US government's official perspective on Microsoft's security competence, there's the federal Cyber Safety Review Board report released in April this year: • https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review... (2024) "Throughout this review, the board identified a series of Microsoft operational and strategic decisions that collectively points to a corporate culture that deprioritized both enterprise security investments and rigorous risk management," the report reads. And so on. Note that the problems didn't start in 2022, that's just the earliest I could be bothered looking with minimal effort. ;)
- Muromec 2y ago
  That's the problem, the only security culture it produces is thinking of security as annoying box ticking.
- jajko 2y ago
  Company pushing constant snooping of all activity of users even on professional/enterprise variants of their OS can't be taken seriously re security, so absolutely no idea where this rumor 'They’re known for being great at serving and selling to the enterprise' comes from. They may be good when luring in customers, but once thats done, they don't give a fuck about anything but their current cash flow. And the fact that ultra-big players can ask them for customized OS distribution that has this turned off (just like my own mega corporation) doesn't change anything on statements above.
tptacek 2y ago
This is something people on message boards believe that practitioners roll their eyes about.

danpalmer 2y ago

I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture.

outworlder 2y ago
It's hit and miss. They have one of the largest cyber security operations worldwide and regularly track and dismantle criminal operations. There's some great people working there. Then there's Azure. Which is used by large organizations and you would expect it to have the utmost care when it comes to security. But it often does badly, in several instances it allowed different tenants to access information from one another, something unheard of on AWS. For example: https://www.securityweek.com/microsoft-patches-azure-cross-tenant-data-access-flaw/ https://www.securityweek.com/microsoft-patches-azure-cross-t... or https://www.theregister.com/2024/06/05/tenable_azure_flaw/ https://www.theregister.com/2024/06/05/tenable_azure_flaw/ or https://borncity.com/win/2023/08/03/microsoft-as-a-security-risk-azure-vulnerability-unpatched-since-march-2023-heavy-criticism-from-tenable-part-2/ https://borncity.com/win/2023/08/03/microsoft-as-a-security-... There are so many cross tenant vulnerabilities that there could be some overlap in those URLs, and it's a bit late at night for me to read those carefully, but you get the idea. They do get the most flak about Windows, which used to be a non networked, single user OS.
cassianoleal 2y ago
> Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture. If the whole value is in ticking the box, why would that develop a culture that values anything more than the tick?
- antonvs 2y ago
  The cycle usually goes something like box ticking, complacency, security scare, remediation, rinse and repeat.
justinclift 2y ago
> but this surprises me Unfortunately, it's true. People used to relying on Microsoft understandably don't want it to be so, so they're in for a rough time trying to figure out actually workable alternatives. :( This has been an ongoing problem for years, and every time some new problem is found Microsoft just trots out the PR promises that they'll do better. Without then doing any better. • https://arstechnica.com/information-technology/2022/10/how-a-microsoft-blunder-opened-millions-of-pcs-to-potent-malware-attacks/ https://arstechnica.com/information-technology/2022/10/how-a... (2022) • https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec... (2023) • https://arstechnica.com/information-technology/2024/04/microsoft-blamed-for-a-cascade-of-security-failures-in-exchange-breach-report/ https://arstechnica.com/information-technology/2024/04/micro... (2024) For the US government's official perspective on Microsoft's security competence, there's the federal Cyber Safety Review Board report released in April this year: • https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review... (2024) "Throughout this review, the board identified a series of Microsoft operational and strategic decisions that collectively points to a corporate culture that deprioritized both enterprise security investments and rigorous risk management," the report reads. And so on. Note that the problems didn't start in 2022, that's just the earliest I could be bothered looking with minimal effort. ;)
Muromec 2y ago
That's the problem, the only security culture it produces is thinking of security as annoying box ticking.
jajko 2y ago
Company pushing constant snooping of all activity of users even on professional/enterprise variants of their OS can't be taken seriously re security, so absolutely no idea where this rumor 'They’re known for being great at serving and selling to the enterprise' comes from. They may be good when luring in customers, but once thats done, they don't give a fuck about anything but their current cash flow. And the fact that ultra-big players can ask them for customized OS distribution that has this turned off (just like my own mega corporation) doesn't change anything on statements above.

tptacek 2y ago

This is something people on message boards believe that practitioners roll their eyes about.