Microsoft Overhauls Security Practices After Major Breaches – Source: www.databreachtoday.com

Governance & Risk Management
,
IT Risk Management

Company Plans to Link Executive Compensation to Achieving Security Milestones

Chris Riotta (@chrisriotta) •
May 6, 2024    

Microsoft is overhauling its security practices and implementing key federal recommendations following a series of recent high-profile breaches that sparked concerns about the global corporation’s cyber posture.

See Also: Live Webinar | From Risk-Based Vulnerability Management to Exposure Management: The Future of Cybersecurity

Charlie Bell, executive vice president for Microsoft Security, said Friday in a blog post that the company will expand its Secure Future Initiative to combat escalating cyberattacks, strengthen privacy protections and secure Microsoft networks.

“Microsoft plays a central role in the world’s digital ecosystem, and this comes with a critical responsibility to earn and maintain trust,” Bell said. “We must and will do more.”

Microsoft launched its Secure Future Initiative in November 2023 when it rolled out new identity protections, software development requirements and a more rapid approach to vulnerability detection and response.

The company has been the target of multiple hackings since then (see: Microsoft’s Latest Hack Sparks Major Security Concerns). Russian hackers compromised its source code repositories and internal systems in a breach first disclosed in January, and a China-based threat actor known as Storm-0558 gained access to Microsoft Outlook systems in July, stealing emails from 25 organizations.

A federally empaneled Cyber Safety Review Board conducted a seven-month review of Microsoft’s security practices following the recent hacks and blamed the company’s “corporate culture that deprioritized enterprise security investments” for allowing preventable security breaches.

The board recommended that cloud service providers increase transparency around security incidents, enhance digital identity protections, adopt audit logging standards and notify victims of future breaches.

“It is imperative that cloud service providers prioritize security and build it in by design,” DHS Undersecretary of Policy and CSRB Chair Robert Silvers said in a statement at the time.

The announcement said Microsoft will “adopt more fine-grained partitioning of identity signing keys and platform keys” following the recent security compromises while working to ensure identity and public key infrastructure systems “are ready for a post-quantum cryptography world.”

Microsoft will also begin linking executive compensation to progress in achieving certain security milestones, the blog said, and will incorporate those goals as a component of its hiring decisions. The expanded initiative will be guided by three overarching security principles, according to Bell: secure by design, secure by default and secure operations.

As part of its expanded Secure Future Initiative, Microsoft will eliminate the entirety of identity lateral movement between tenants, environments and cloud networks. The company said it will enforce continuous least privilege access to all of its applications and users moving forward and ensure that only “secure, managed, healthy devices” can be granted access to Microsoft tenants.

The announcement also said that Microsoft will build and maintain software bills of materials for all of the software assets used to deploy and operate its products and services. All security logs will be kept for at least two years and six months and will be accessible from a central data bank “to enable efficient and effective security investigation and threat hunting.”

In addition to the expanded initiative, Microsoft said it will also be implementing a new security governance framework developed by its chief information security officer, which includes collaborative partnerships with deputy CISOs and engineering teams.

“Ultimately, Microsoft runs on trust and this trust must be earned and maintained,” Bell said. “Our promise is to continually improve and adapt to the evolving needs of cybersecurity. This is job number one for us.”