Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be “more important even than the company’s work on artificial intelligence.”
Satya Nadella, Microsoft’s CEO, “has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security,” Smith told Congress.
His testimony comes after Microsoft admitted that it could have taken steps to prevent two aggressive nation-state cyberattacks from China and Russia.
According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the “security nightmare.” Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem, choosing profits over security, ProPublica reported.
This apparent negligence led to one of the largest cyberattacks in US history, and officials’ sensitive data was compromised due to Microsoft’s security failures. The China-linked hackers stole 60,000 US State Department emails, Reuters reported. And several federal agencies were hit, giving attackers access to sensitive government information, including data from the National Nuclear Security Administration and the National Institutes of Health, ProPublica reported. Even Microsoft itself was breached, with a Russian group accessing senior staff emails this year, including their “correspondence with government officials,” Reuters reported.
You can have audits done on proprietary software. Just because the public can’t see it doesn’t mean nobody else can.
That just moves requiring trust from the 1st party to 2nd or 3rd party. Unreasonable trust.
Do you yourself actually audit the software you use, or do you just trust what others say?
Wait…you don’t audit every package and dependency before you compile and install?
That’s crazy risky my man.
Me? I know security and take it seriously, unlike some people here. I’m actually almost done with my audit and should be ready to finally boot Fedora 8 within the next 6-8 months.
This is like asking if you do scientific experiments yourself or do you trust others’ results. I distrust private prejudice and trust public, verifiable evidence that’s survived peer review.
Scientists in the room who have to base their experiments off other peoples data and results:
Tongue in cheek but this is actually giving me particular headache because of some results (not mine) that should have never been published.
That sucks, but the answer to bad results is still more/better tests 😇
If you’re a big enough organization (like the US government) you can pay anyone you want (or even your own people) to audit Microsoft’s code.
@fuckwit_mcbumcrumble @tabular I’ve never worked at Microsoft, but I worked at a different enterprise company and they did indeed fly in representatives of different governments who got free access to the code on a company laptop in a conference room to look for any back doors. I always thought it was silly because it is impossible to read all the code.
If I’m a government I’m hella criminalising the sharing of proprietary software.