Microsoft Chose Profit over Security, Whistleblower Says • Hacker News Board

Re: Microsoft Chose Profit over Security, Whistleblower Says

#241

Post by tombert » Thu, Jun 13, 2024, 10:44 PM UTC

progmetaldev wrote: post #222

tombert wrote: post #192

Earlier quoted context omitted.

> you still need a os. and i fail to see how nix would make video driver problem any better. That's actually easy to answer; video drivers can be really finicky to get working. If you screw it up, it's very easy to get into a state where you have no GUI. Nowadays I am proficient enough to work my way around the command line and I probably could fix a bad driver, but 13 years ago that wasn't really the case, and if I…

I'm willing to bet that you knowing NixOS is going to make Debian installation a completely easy and smooth experience. If you can use Debian stable, you are going to setup a rock solid system for your parents. If you can start the installation by using an Ethernet cable instead of wireless, I think you will have an easier time, but once you get all the updates complete you should be able to switch over to wireless f…

Oh I have no doubt that I could easily set up Debian now if I wanted to. Since that last time I tried it I've installed Arch and Gentoo and Ubuntu Server (converted into a desktop OS) and ran through the Linux From Scratch book once. I'm pretty sure that I could get the 2009 version I had trouble with as a 19 year old working pretty easily now.

Sadly, I don't think I'll be able to convince my parents to switch to Linux in the super near future; I need to work on them for awhile and maybe I can convince my dad (though he's pretty entrenched in Windows).

Re: Microsoft Chose Profit over Security, Whistleblower Says

#242

Post by NordSteve » Thu, Jun 13, 2024, 10:58 PM UTC

Arrath wrote: post #194

ein0p wrote: post #123

Earlier quoted context omitted.

Not just onboarding. Most, if not all, large companies waste at least an hour of their employees time on this per year, while themselves bribing politicians in DC.

An hour? My annual training is typically about 6 hours of drudgery, and often about 2/3rds repeat courses from years previous. Great fun.

That's just the ethics training, depending on your role there's much more than that.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#243

Post by pwarner » Thu, Jun 13, 2024, 10:58 PM UTC

orf wrote: post #221

shortsunblack wrote: post #216

The solution is complete zero trust and distrusting the network in organizations. You should treat the internal network as external -- hostile. Google does this. They were the first ones to widely adopt zero trust with BeyondCorp and there has not been a Google internal organizational breach since Aurora (which made them adopt BeyondCorp, what they call zero trust). You have completely managed endpoints, strong harde…

> You have completely managed endpoints, strong hardening of the endpoint and complete inventorization of all the resources in the organization. You have certificates installed onto each device. You have an ACL engine that determines whether a user should get access to a particular resource. None of those are “solved” for any mid or large-sized enterprise where tech isn’t their code competency. In fact, I’d say most…

The first step to saying you're not doing any of that is saying you're not doing it. I work at an older company and it has successfully moved an number of apps to this model. Some will take another decade, but many are there.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#244

Post by waterhouse » Thu, Jun 13, 2024, 11:02 PM UTC

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

https://en.wikipedia.org/wiki/Lavabit famously shut down rather than compromise its security.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#245

Post by Hikikomori » Thu, Jun 13, 2024, 11:04 PM UTC

shortsunblack wrote: post #216

The solution is complete zero trust and distrusting the network in organizations. You should treat the internal network as external -- hostile. Google does this. They were the first ones to widely adopt zero trust with BeyondCorp and there has not been a Google internal organizational breach since Aurora (which made them adopt BeyondCorp, what they call zero trust). You have completely managed endpoints, strong harde…

For most companies Zero Trust is strong device management, cert in TPM, buy okta service and then buying an appliance that you put between users and services and then cut off direct user access. Can still use vpn or expose the appliance to the internet.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#246

Post by Zelphyr » Thu, Jun 13, 2024, 11:09 PM UTC

madrox wrote: post #239

I don't see a future here that doesn't involve significant legislation over network security and include jail time for major offenses. Every time something like this happens, there's always that organizational Cassandra (usually the CISO) that saw it all coming but was ignored. Sooner or later someone will get burned badly enough that the consensus will be that tech cannot regulate itself on security. We've already g…

I can think of one solution to the "too few players" problem. Break them up.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#247

Post by [deleted] » Thu, Jun 13, 2024, 11:19 PM UTC

VyseofArcadia wrote: post #49

minisooftwin wrote: post #39

> “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security,” the company’s CEO, Satya Nadella, told employees. Satya's model of making security a priority at Microsoft: - Cram ads in every nook and corner of Windows. Left, right, centre, back, front, everywhere. What else is an operating system for? - Install a recorder which records everything you do. For the benefi…

The Microsoft bribes scandal broke not too long after I had to take the "hey don't do bribes" training at Microsoft. That event really drove home for me the fact that all of the trainings, emails, processes, etc. are mostly plausible deniability. There are people who care about security at MS. I know, I've met them, but for the most part all of this exists so that Satya can plausibly say in court or in front of congr…

[deleted]

Re: Microsoft Chose Profit over Security, Whistleblower Says

#248

Post by anarazel » Thu, Jun 13, 2024, 11:21 PM UTC

pimlottc wrote: post #151

JohnMakin wrote: post #73

The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not sure at this point what could even trigger one. I've always dabbled in cybersecurity, taking on the hat in various roles over the years but have refused to go full time into it due to what I have personally seen in the industry - an overwhelming focus on comp…

In the profit-center view, everything is either a cost center or a profit center. And it is nearly impossible to get anyone to truly care about a "cost center".

In my experience, the conflict in many bigger orgs isn't even on the cost vs profit axis, it's on the tangible vs non-tangible axis. It's a lot easier for middle managers to show they did well if they deliver customer impacting features than a nebulous "improved security". This is item true even when higher up management actually wants to invest in security.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#249

Post by weitendorf » Thu, Jun 13, 2024, 11:26 PM UTC

shortsunblack wrote: post #216

The solution is complete zero trust and distrusting the network in organizations. You should treat the internal network as external -- hostile. Google does this. They were the first ones to widely adopt zero trust with BeyondCorp and there has not been a Google internal organizational breach since Aurora (which made them adopt BeyondCorp, what they call zero trust). You have completely managed endpoints, strong harde…

Google makes zero-trust work by having a highly "centralized" or "uniform" tech stack all the way from tooling, to hosting, to infra. So everything defaults to zero-trust and it's not something you would need to think about setting up.

Most big organizations have built up their internal/external tech over decades, with large parts of it being essentially "mothballed", and high degree of heterogeneity stemming from tech changes over time/acquisitions/departments having flexibility in what tools and design they can use. Shifting to zero-trust requires a lot of migration work across all of this, "training" ie figuring out how to get stubborn IT people to buy in to the new way of doing things, and most likely a shift to the "centralized" kind of model that Google uses.

Even if the first two are funded, that third "centralized"/"uniform" model can be very expensive. One of the reasons Google has to deprecate things so much is that the centralized model requires constant migrations and breaking upgrades to keep things running, which makes it so "mothballing" isn't a thing: you either have enough people assigned to handle the migrations, or turn it down.

I agree that zero-trust is the best security model and it solves many problems. But I guess I'm also saying it's much easier said than done. With my startup I want to solve a lot of these kinds of problems (ie introducing "uniformity" that follows best practices) for my customers, but it's inevitable that some point a customer will ask for the ability to "turn off zero-trust and allow for IP whitelisting" - is it worth it to close a potentially big deal? It's also probable that any reasonably successful company will at some point perform an acquisition involving a company without a zero-trust model - is that reason to cancel the acquisition?

Re: Microsoft Chose Profit over Security, Whistleblower Says

#250

Post by drivebycomment » Thu, Jun 13, 2024, 11:31 PM UTC

jrm4 wrote: post #63

spydum wrote: post #44

As per usual, executive platitudes around "security first" don't matter. If you pay and promote people for features, and don't reward security culture, people are not dumb: they and the management layers will optimize for that. I don't know how to design incentives to solve for this, but this is always going to be the way it is.

I do. It's law, regulation and liability. Until heads roll, until someone is punished, likely nothing will happen.

This is a non-solution, and automatic "head rolling" and punishments will only lead to reducing the actual meaningful experience accumulation - the mean time between major breaches like this is long enough and variable enough that the next person would be likely equally incompetent, inexperienced and inattentive.

There's no easy solution, because it's inherently very difficult problem - making a correct trade-off between security and everything else for the society, and determining what exact line needs to be drawn, are inherently extremely difficult problem, and no amount of laws and punishments will help with finding the right balance.

I do like what CISA seems to be trying to do, and I think they can do a lot more here - I think we need CSRB or some similar org to get to a place where NTSB is - I think the key value of NTSB for humanity is ensuring that some of the critical knowledge around safety incidents get accumulated and shared across. Right now, learnings from key infosec incidents are not broadly shared in any reasonable timeframe, if ever, and so we repeat the mistake over and over again.