We needed an article to make sure this was clear.
Microsoft Chose Profit over Security, Whistleblower Says
111–120 of 318 posts
Re: Microsoft Chose Profit over Security, Whistleblower Says
#112> “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security,” the company’s CEO, Satya Nadella, told employees. Satya's model of making security a priority at Microsoft: - Cram ads in every nook and corner of Windows. Left, right, centre, back, front, everywhere. What else is an operating system for? - Install a recorder which records everything you do. For the benefi…
The Microsoft bribes scandal broke not too long after I had to take the "hey don't do bribes" training at Microsoft. That event really drove home for me the fact that all of the trainings, emails, processes, etc. are mostly plausible deniability. There are people who care about security at MS. I know, I've met them, but for the most part all of this exists so that Satya can plausibly say in court or in front of congr…
Eh. For the most part, the trainings can be taken at face value. Even if the management's dealings with governments and partners are questionable, no company wants random employees accepting personal kickbacks from vendors.
There's a liability avoidance component to trainings, but mostly for non-business misconduct. For example, for sexual harassment, the company will say they tried everything they could to explain to employees that this is not OK, and the perpetrator alone should be financially liable for what happened. That defense is a lot less useful in business dealings where the company benefits, though.
Re: Microsoft Chose Profit over Security, Whistleblower Says
#113Surely, a whistleblower is someone who reveals a truth that nobody
knows?
Re: Microsoft Chose Profit over Security, Whistleblower Says
#114Earlier quoted context omitted.
Real security cannot be feature. Your complete system design and other features should be based on the idea of ”security first”, if you really want to build secure systems.
> Your complete system design and other features should be based on the idea of ”security first”, if you really want to build secure systems. One can argue that the most secure system is the one turned off and not used. And i am not talking about devices with builtin batteries.
One can always argue that, but, fundamentally security is about limiting the systems' use for its purpose and eliminate all unwanted scenarios.
If you need to use the system, you cannot turn it off or not to use it.
Re: Microsoft Chose Profit over Security, Whistleblower Says
#115As per usual, executive platitudes around "security first" don't matter. If you pay and promote people for features, and don't reward security culture, people are not dumb: they and the management layers will optimize for that. I don't know how to design incentives to solve for this, but this is always going to be the way it is.
Managers are already held accountable for their teams when they underperform. The same should also apply for their security blunders.
Re: Microsoft Chose Profit over Security, Whistleblower Says
#116The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not sure at this point what could even trigger one. I've always dabbled in cybersecurity, taking on the hat in various roles over the years but have refused to go full time into it due to what I have personally seen in the industry - an overwhelming focus on comp…
This is exactly it. There is no incentive to prioritise security. It is not visible to customers, except in terms of compliance, most likely a check-list approach. I think it needs a massive cultural shift, but from customers. If customers were willing to evaluate security (consumers cannot, but enterprise can) properly, demand binding assurances, and make buying choices accordingly industry would respond. Of course…
When I first left offensive security consulting and joined an internal defensive team, a wise ex-agency person said to me "In product development, the first things to often get axed are security, and performance. They are invisible to the user, until they aren't, and rarely do failures in those areas end a company."
Granted this was prior to ransomware really blowing up, but even that itself is a different threat model that doesn't mean your product has to be good at security.
Re: Microsoft Chose Profit over Security, Whistleblower Says
#117The hearing will be streamed on YouTube in ten minutes from this comment:
Re: Microsoft Chose Profit over Security, Whistleblower Says
#118Business decisions involve profits against everything, not just security. Delaying shipments to make a product more secure can affect revenue targets.
Re: Microsoft Chose Profit over Security, Whistleblower Says
#119Earlier quoted context omitted.
Yes, massive companies are a nest of conflicting priorities. The sales team wants to do whatever it takes to win the deal, and the legal team wants everyone to behave ethically at all times. The board wants to be shocked(!) when it turns out those goals are in conflict, with the ethical side sometimes losing out, to remove any personal risk to themselves.
> legal team wants everyone to behave ethically at all times do you really believe that? compliance under scrutiny, more like it
The best job is sitting around and doing nothing. So ideally yes.
But sure, ethically speaking when things get heated they will exploit every loophole they can find to avoid liability. So, lawful evil?
Re: Microsoft Chose Profit over Security, Whistleblower Says
#120This whole article seems a bit odd to me. What is "the product" ? Presumably this is not related to earlier problems with SolarWinds. Did MS screw up. Yes. However, all things have bugs. I takes one person finding one bug and exploiting it. and there are enormous resources going into finding one, and I am certain that this is the only one. I am sure the NSA is sitting on a pile of them. Whereas the developers have to…
Because as far as I can tell, there was no "vulnerability" here, it's just how the product works. Stealing an OAuth key is just as bad. Stealing a domain's krbtgt key is just as bad. Businesses want that when they login to a computer, they are SSO'ed in to all their apps. That's how ADFS works, you authenticate to it using kerberos and it issues you a SAML token. Here they stole apparently the key used to sign the SA…
>Stealing an OAuth key is just as bad
What is an "OAuth key"? Do you mean an OAuth token? No, Golden SAML is worse than stealing an OAuth token, because an OAuth token is valid for 1 user, but Golden SAML can be used to impersonate any user. Also, OAuth tokens expire, but Golden SAML doesn't expire (although if you steal an OAuth refresh token, that won't expire).
>I fail to see how in this particular incident its Microsoft's fault.
Andrew Harris wanted to warn customers about the weakness, and tell them they can prevent the weakness by disabling seamless SSO. Other Microsoft people said no, that would alert hackers to the attack, we want to keep the attack secret, and it also would jeopardize our contracts by making the default setting sound insecure. Then Golden SAML was published publicly, so that first reason was no longer valid, but Microsoft still wouldn't tell customers they could prevent the attack by disabling seamless SSO. Then Solarwinds happened, and Microsoft finally advised customers to disable seamless SSO.