Microsoft overhaul treats security as 'top priority' after a series of failures | Hacker News Reader

Microsoft overhaul treats security as 'top priority' after a series of failures

theverge.com

29 pointstosh16 comments

The nice thing about priorities is there can be so many of them, no need to really choose. I'm sure there are plenty of people at Microsoft who are saying, "right, security is their top priority, but mine is {profit, compatibility, promotion, market share, hobbling open source, promoting open source, offloading liability}.

This is usually true, but the CEO is very clear here - when faced with a choice between security and something else, every employee must choose security. And to head off the possibility that some exec chooses differently, a portion of each exec’s compensation is tied to the security initiative.

It’s always difficult to change the direction of a company this size (or even 10 times smaller), but it appears as if Satya has done a reasonable job aligning people’s incentives.

They may still fail, or not make enough progress in a reasonable timeframe, but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do.

> usually true, but the CEO is very clear here - when faced with a choice between security and something else

the challenge is "how can you prove that this risk will materialize and will cause $3 damage - while the pill costs $5 - and what will the shareholders do". I've been in Audit/GRC/Security for enough years to have had enough 'fights' on risk management. With very few exceptions, the money defines the risk and not the other way around.

If history has taught us anything, it will be IT-Sec-trainwrecks-all-the-way-down.

> but that’ll happen because the problem is hard to solve and not because people ignored what their CEO and senior leadership told them to do

no disrespect to a/this CEO.. but he is 'just' an employee. And he can always tell different things to the Townhalls and the Press/Media, but pull a U-turn. All he has to do is reduce the budget of X-dept, reduce the headcount/org-chart of Y-dept, and while the intentions are great, the effort is not supports (I've made one more comment on this thread about staffing initiatives somewhere higher/lower in this article's comments)

I’m fairly skeptical too, and only time will tell. FWIW I don’t think highly of Microsoft when it comes to security. But two things that may be positive:

1) there is precedent for Microsoft doing a strong 180 when it comes to security, driven by the original trustworthy computing memo of 2002. We’ll see if Satya means this level or not

2) it looks like they’re being hurt by the most important motivator of all: money. If they don’t tidy up their act fast, govt and industry will come down hard on them. The US is losing the cyber persistence game to China and it’s a national security risk

Edit: precedent/president

Funny story about priorities. My boss once gave me two top priorities. I told her, "there can be only one". She resisted a bit, but luckily these two projects literally required sacks of cement to be brought from hundreds of kilometers away by truck (context: humanitarian aid). I said, "if only enough cement arrives for one of them on the next truck, which one gets it?"

It was at that moment she understood why there can be only one top priority. She was a good boss, and learned a lot from working with a hard-headed engineer.

I’d love to see an honest blog post from MS after all this effort on what worked and didn’t.

A massive horizontal effort like this is especially challenging after accruing substantial security debt over years

I missed working in US mega-corps. When they announce initiatives like that (with fanfare), and spend 50% of time and effort on marketing and planning, and 20% on the actual effort (as new resources are not added and existing resources are not 'allowed' to dedicate any/much time on that latest new initiative).

I was listening to Security Now a couple of weeks ago (I didn't read/research on this further) and they said that some LLM ran through the CVEs and from the description only managed to successfully create code to take advantage in 70%-80% of them.

It is amusing how MS is losing the "NOBUS" game, got bitch-slapped by the EDPS a couple of months ago, and need to say/do something to save face.

In Project Management the deal is "say-do-say". To what @wepple wrote above, it would be interesting to see on a semi-annual basis what the latter 'say' is (what did they actually did/and it worked). Understanding the sensitivity of security impact "hey we found XYZ vuln on ABC system" would be irresponsible for people still using said-ABC outdated system.

(semi-rant, but my honest thoughts)(I wish MS the very best, I got some stocks of MS so I want them to succeed) :)

What's the catch? Will this mean things like DRM, lock-in, and walled gardens take priority? It's very hard to put security first in an absolute sense- I'm sure some of their products shouldn't even exist if that were the case. It will be very interesting to see what this all means in practice. I like the proposed incentives they've created.

Satya (CEO) said in an internal communication that if you need to choose between security and features then choose security. Another important thing is that they will include "security" as a dependency when calculating remuneration for the executives. There is also a wide shift to improve everything at the moment, some on Blind complain about the amount of patching and other improvements and key rotations they need to do. Some good stuff should come out of it.

I thought Microsoft's top priority was putting weird ads and pushy tie-ins into their good products to sell people on their mediocre products like Bing and MSN?

Yeah I am waiting when customer satisfaction will become another 'top priority', but not holding my breath

It's ok as long as the ads are delivered over TLS...

This feels like one of those nice things you put in the company values PDF, and when someone in the Windows team logs into work on Monday, they have a high priority ticket on fixing a compatibility issue where a nine-year-old business software has stopped working with the latest Windows 11 patch. I'll be fucking amazed if Windows actually decides to start breaking legacy shit in the name of security.

Well MS is selling Linux by now so stranger things may happen, but talk is somewhat cheaper than implementing good practices.

If security is the top priority then performance, ease of use, system malleability can no longer be the top priority.

If they really prioritize security, backward compatibility (Microsoft's bread and butter) will be the thing that really gets compromised.

It's the right decision for the long-term, but some people are going to be really angry with them. I hope they can pull it off.

Reply on news.ycombinator.com