Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Despite doubts, federal cyber experts approved Microsoft cloud service

propublica.org

Post reply on HN
Print view View original

11–20 of 249 posts

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#11

Post by fdghrtbrt »

dogleash wrote: post #9

> By late 2024, FedRAMP reviewers concluded that they had little choice but to authorize the technology — not because their questions had been answered or their review was complete, but largely on the grounds that Microsoft’s product was already being used across Washington. The article talks a lot about conflicts of interest, but this is the line I went looking for. A bureaucracy fighting itself over goal prioritiza…

If you "went looking for" this line, you're just reading into the statements your preconceptions.

I on the other hand have no expectation, and so it's not clear whether the "bureaucracy fighting itself" is a cause or a symptom. You're implying it's a cause and the solution is "less red tape". But it could be just a symptom of conflicts of interest, and less red tape just leads to more efficient corruption.

Again, you're just reading into it what you already believe in.

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#13

Post by debarshri »

Recently tried using Entra ID. There are 12 ways to enforce MFA, 20 days ways to disable users, 4 ways to authenticate users, Add conditional access stuff with 50 variables and templates etc.

You can customize the way you want. After configuring it, my colleagues could not log in. Thats one way to secure your organization.

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#15

Post by hiddencost »

ddtaylor wrote: post #12

The government does most things poorly and with little regard to budget or quality. They can't solve problems that are much simpler than cloud computing, so why should I expect them to perform better at a more complex problem?

Basically false. They're better at health care. Better at education. Better at feeding people. Better at charity.

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#16

Post by gertrunde »

It's not very clear from the article, but I get the feeling from the context that the 'pile of shit' quote referenced the package of documentation about the service rather than the service itself.

(That seems to be the main complaint, that Microsoft never provided the clear information required to conduct the assessment properly).

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#17

Post by chii »

jbombadil wrote: post #5

> [...]And because federal agencies were allowed to deploy the product during the review, GCC High spread across the government as well as the defense industry. By late 2024, FedRAMP reviewers concluded that they had little choice but to authorize the technology — not because their questions had been answered or their review was complete, but largely on the grounds that Microsoft’s product was already being used acro…

It's why these enterprise vendors want foot in the door at all costs.

They know that if they get entrenched first, it's impossible to migrate away. That's basically free money from a customer that has zero cost ceiling.

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#19

Post by 21asdffdsa12 »

gertrunde wrote: post #16

It's not very clear from the article, but I get the feeling from the context that the 'pile of shit' quote referenced the package of documentation about the service rather than the service itself. (That seems to be the main complaint, that Microsoft never provided the clear information required to conduct the assessment properly).

Wait- so they basically threw up their hands? No documentation! Not evaluable? Thus clearly of value for somebody? Big stamp, job well done! NEXT?

Re: Despite doubts, federal cyber experts approved Microsoft cloud service

#20

Post by yoyohello13 »

debarshri wrote: post #13

Recently tried using Entra ID. There are 12 ways to enforce MFA, 20 days ways to disable users, 4 ways to authenticate users, Add conditional access stuff with 50 variables and templates etc. You can customize the way you want. After configuring it, my colleagues could not log in. Thats one way to secure your organization.

That’s Microsoft. 1000s of features and none of them really work the way they are supposed to.
Post reply on HN