Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
United States Microsoft Security

Scathing Federal Report Rips Microsoft For Shoddy Security (apnews.com) 81

Posted by msmash from the not-mincing-words dept.
quonset shares a report: In a scathing indictment of Microsoft corporate security and transparency, a Biden administration-appointed review board issued a report Tuesday saying "a cascade of errors" by the tech giant let state-backed Chinese cyber operators break into email accounts of senior U.S. officials including Commerce Secretary Gina Raimondo.

The Cyber Safety Review Board, created in 2021 by executive order, describes shoddy cybersecurity practices, a lax corporate culture and a lack of sincerity about the company's knowledge of the targeted breach, which affected multiple U.S. agencies that deal with China. It concluded that "Microsoft's security culture was inadequate and requires an overhaul" given the company's ubiquity and critical role in the global technology ecosystem. Microsoft products "underpin essential services that support national security, the foundations of our economy, and public health and safety."

The panel said the intrusion, discovered in June by the State Department and dating to May "was preventable and should never have occurred," blaming its success on "a cascade of avoidable errors." What's more, the board said, Microsoft still doesn't know how the hackers got in. [...] It said Microsoft's CEO and board should institute "rapid cultural change" including publicly sharing "a plan with specific timelines to make fundamental, security-focused reforms across the company and its full suite of products."
This discussion has been archived. No new comments can be posted.

Scathing Federal Report Rips Microsoft For Shoddy Security More

Scathing Federal Report Rips Microsoft For Shoddy Security

Comments Filter:

  • It's Microsoft (Score:5, Insightful)

    by Ol Olsoc ( 1175323 ) on Wednesday April 03, 2024 @09:06AM (#64366444)
    Not to put too fine a point on it, if you are concerned about computing security, you shouldn't be using Microsoft products.

    All products have some security issues, but Microsoft beats them all.

    And don't think that a mere presidential order is going to get them to change their culture. Well, maybe if the US marines were to invade Redmond...

    • Well, maybe if the US marines were to invade Redmond...

      How would they make anything better. They would shoot all the people and equipment that was in the building, but the most the algorithm that has been running Microsoft for the last 20 years would survive.
      You can't shoot math.

      The marines would try tho.

    • Microsoft is the largest cybersecurity vendor (Score:5, Interesting)

      by brunes69 ( 86786 ) <slashdot@nOSpam.keirstead.org> on Wednesday April 03, 2024 @09:19AM (#64366522)

      Meanwhile, Microsoft is the world's largest cybersecurity vendor.

      Microsoft currently earns $20B / year in cybersecurity revenue, more than any other standalone security company.

      Ironically, they also build the products that people are paying them to secure.

      • Re:Microsoft is the largest cybersecurity vendor (Score:5, Interesting)

        by Ol Olsoc ( 1175323 ) on Wednesday April 03, 2024 @09:22AM (#64366540)

        Meanwhile, Microsoft is the world's largest cybersecurity vendor.

        Microsoft currently earns $20B / year in cybersecurity revenue, more than any other standalone security company.

        Ironically, they also build the products that people are paying them to secure.

        Exactly - it's quite the plan. Produce less than secure software, then require the purchasers to spend more money to "secure" it. But always another security hole to patch, and invoices to be produced.

        • Re: (Score:3)

          by bobby ( 109046 )

          Yeah, but why do the buyers keep buying this crap? What will it take for someone to wise up and change to something more manageable and more secure?

          • It's just inertia. Too many others use it to just ignore it.

            • It's just inertia. Too many others use it to just ignore it.

              It's a bit like how VHS was the standard consumer videotape format. Also was pretty much the worst quality.

          • Yeah, but why do the buyers keep buying this crap? What will it take for someone to wise up and change to something more manageable and more secure?

            You can't if you have any sort of people involved in the decision making process that are popularity contest style thinkers. "But everybody else does it" is pretty much the only reason they need. It was a sad day when our all Linux network was converted to Windows, but also the day I gave up on having any control on the network itself.

            If the cure is risking not being one of the crowd? Nobody wants the cure.

        • > But always another security hole to patch...

          And there always will be. You imply that Microsoft is intentionally leaving security flaws in their software and extorting people for additional security.

          Software development does not work like that.
          Computer security does not work like that either.

          A good piece of computer security rests in poking you until you update your own software to fix known issues. And most institutions do need that poking.

          • > But always another security hole to patch...

            And there always will be. You imply that Microsoft is intentionally leaving security flaws in their software and extorting people for additional security.

            Software development does not work like that.

            Are you done with the assumptions of what I "imply"? The software is not very good. It just isn't. People who only use the Office suite are loving it, I suppose, but outside of that narrow use case, it is not very good. It does a good job of breaking on updates, especially for some aspects like audio, and it breaks during the update process even before installation of the updates that you have almost no control over - I've had Enterprise do a BOHICA update on me at the most inopportune moments.

            So is it

        • Exactly - it's quite the plan.

          I think that's stretching things a bit. I really doubt that anyone proposed "Let's make insecure software so we can sell services to secure it!".

          Rather, they made insecure software because they didn't care enough about security to do it properly, then someone noticed that this had created an exploitable business opportunity.

          • Exactly - it's quite the plan.

            I think that's stretching things a bit. I really doubt that anyone proposed "Let's make insecure software so we can sell services to secure it!".

            Rather, they made insecure software because they didn't care enough about security to do it properly, then someone noticed that this had created an exploitable business opportunity.

            I agree with you - perhaps I shouldn't have used the word "plan". They didn't plan anything, but they surely made a lot of money off their incompetence. All it took was the inertia, and the suits believing that most popular = Best.

      • Give new meaning to the old MS motto; "Eat your own dog food."
      • Nobody ever got fired for buying a Microsoft product. Quiet part out loud: Because it's so crap that you get crazy billable hours for it.

        • Nobody ever got fired for buying a Microsoft product. Quiet part out loud: Because it's so crap that you get crazy billable hours for it.

          And it is a real job security thing as well. I like to note that the last place I worked for had an entire division that tried to keep the Windows machines running. I wasn't even an IT guy, but I got roped into supporting the Macs. There weren't as many Macs of course. but there were many more computers per support person for the Macs. And I wasn't busy supporting them, they didn't need it.

          I was pretty good at pissing off the people who claimed that Macs were so expensive when I asked if the millions we

    • Re: (Score:2)

      by gweihir ( 88907 )

      Yep. And Microsoft is unfixable. I mean, after 50 years in the business, they cannot even get OS updates right. How can you expect them to get something far more complex than IT security right. The simple fact is that either we let shoddy practices continue or MS needs to die, no alternative.

      • > they cannot even get OS updates right.

        Which OS update did they fumble? ... as opposed to not patching something that they couldn't validate before the monthly Patch Day release? (Or alternately the Emergency Patch Release window?)

        While I have my own complaints about their OS updates, it's because they've used them for pushing features as well as security, and some of those features were user-hostile. (Windows Genuine Advantage, anyone?)

        • > they cannot even get OS updates right.

          Which OS update did they fumble? ... as opposed to not patching something that they couldn't validate before the monthly Patch Day release? (Or alternately the Emergency Patch Release window?)

          While I have my own complaints about their OS updates, it's because they've used them for pushing features as well as security, and some of those features were user-hostile. (Windows Genuine Advantage, anyone?)

          As a person who uses a lot of audio, Just about every update causes problems. The audio quits working in the middle of downloading the updates. Pretty strange.

          It would do weird things like rename all the audio drivers (like 30 of them) to a different name - it took the first one it finds, and names all the others the same, and appends a number on them. So the software stops working, and you have to go in and manually rename the drivers, then set up the software again.

          It nuked a number of my systems when

          • Had I points for it, I would upvote you.

            A reply which is informative, relevant to the post it is replying to, and non-confrontational. I appreciate replies such as this.

            Hail, friend, and thank you.

            • Had I points for it, I would upvote you.

              A reply which is informative, relevant to the post it is replying to, and non-confrontational. I appreciate replies such as this.

              Hail, friend, and thank you.

              Thank you! And even after I gave those experiences I just found that some software for a Software defined radio that requires a .dll file - a standard thing in Windows - the .dll file has been deprecated in windows 10 and 11. The .dll is required to calibrate the Si570 chip in the radio.

              I might have to dig up a Windows 7 computer, in the meantime, I'm experimenting with a python software to see if I can get it to work.

  • My 0.02 (Score:5, Insightful)

    by DaMattster ( 977781 ) on Wednesday April 03, 2024 @09:10AM (#64366474)
    Perhaps instead of outsourcing critical stuff like official government email to Microsoft, the government should be doing it in-house with standard, open source resources.

    • Ah, yes, because somehow the guv'min is clearly much better and competent than... than... well, anything, really. In any area of your choosing. /sarcasm^2

      • Ah, yes, because somehow the guv'min is clearly much better and competent than... than... well, anything, really. In any area of your choosing. /sarcasm^2

        Trust me, I've got no great love for government operations, either. To put an even greater point of concern with this plan, there's an extremely valid concern about the federal government publishing all of its source code; security-through-obscurity isn't an ironclad plan by any means, but telling the entire world what source code is being run the sort of thing that has the potential for consequences, since vulnerabilities would be published for adversaries to see. This is especially problematic if security

      • Ah, yes, because somehow the guv'min is clearly much better and competent than... than... well, anything, really./

        And yet we have this current situation where government emails systems were infiltrated due to a private company's incompetence. Then we have the entire Boeing fiasco. Shall we talk about all those explosions at refiners which occur every single year? Perhaps we should talk about private company which killed almost all life in a 60-mile stretch of river [iowacapitaldispatch.com].

        Besides, as we've repeatedly

      • Re: (Score:1)

        by whitroth ( 9367 )

        Bugger off, you ignorant slut.

        I worked for the government for 10 years - at the NIH. Around '16 or so, they went from internally managed email to *fairy dust* M$ managed. Let's start with they were supposed to migrate about 80 people on a Sunday? Monday? night, makes sure it was right, then manage another 800+ people. No one apparently was watching, because M$ migrated EVERYONE, and in spite of protestations that everything was fine, I was helping people in another division a week later, because it was *fuc

        • Ah, yes, a botched 900 people e-mail transition from 8 years ago is clearly a prime example of "corporate bad, government good".

    • Like Clinton did?

      Part of the value proposition for central control over these things is to avoid questionable practices like using a personal email server that isn't following government archival laws. Much easier to enforce at the vendor layer.

      Security and cost are check boxes, but it's control that sells it.

    • If Microsoft is really as important to the government as the government says it is, then nationalize it.

  • Frankly... (Score:5, Interesting)

    by Junta ( 36770 ) on Wednesday April 03, 2024 @09:13AM (#64366490)

    There's probably very few companies that would stand up to this sort of scrutiny by this audience. Probably none of the companies folks have heard of.

    The companies that would be respected by this sort of report generally go out of business in the face of a competitor that is able to deliver more capability at more reasonable pricing.

    • +1 insightful.

    • There's probably very few companies that would stand up to this sort of scrutiny by this audience. Probably none of the companies folks have heard of.

      I'll bet Google would.

      Google's security architecture and processes are head and shoulders above anyone I've seen, and I spent a decade doing security consulting with organizations of all sorts, including banks and even military orgs, before joining Google and getting an inside look at Google's approach. When I first joined Google I was in the payments team, and our annual PCI [wikipedia.org] compliance audits were hilarious. They consisted of a few days of Google engineers explaining to the PCI auditors why the PCI requi

      • ...it would both give people a lot more confidence in how Google handles their data, and provide a blueprint to improve IT security everywhere.

        See, here's the thing: I completely believe you. I absolutely believe that Google's data handling is quite possibly the best in the industry. I believe your statement that PCI Compliance (which is too onerous for a whole lot of main street businesses if you ask them) is too insecure for Google's IT folks. I believe that the models they implement are literally state of the art and that more companies should follow those practices.

        And, in a depressing irony, it makes me trust Google even less.

        Why? Because ho

        • Google may have the most secure datacenters in the world, but that data is being used *somewhere*, for *something*, with no transparency or oversight...and it's the not-knowing that makes the security of their datacenters irrelevant.

          Okay... but assuming all else stayed the same would you feel better or worse about the situation if you knew that Google's data centers were regularly breached? Don't expect that the hackers who break in would publish the data; that's very unlikely.

          As for the rest, I understand and agree. I'm probably less worried about it than you are -- even though I care a lot about privacy -- because I have insight into how the data is used. Not that I see it myself, but if Google were using the data for purposes othe

  • Fire them for using Microsoft.

  • Microsoft is a Sales company that happens to be in tech. Tech that happens to do sales is what we need.
  • Microsoft has security?

  • Microsoft just saved us from the XY backdoor (Score:5, Interesting)

    by Echoez ( 562950 ) * on Wednesday April 03, 2024 @09:22AM (#64366538)

    A Microsoft researcher pretty much single-handedly just saved the world from the XY backdoor. https://arstechnica.com/securi... [arstechnica.com] . Considering this was an open-source project poised to be included as part of Linux and it was found by Microsoft (albeit through luck), I think that's huge.

    Microsoft also creates probably the only good and reliable antivirus software. And Microsoft has been very active in promoting the use of Rust, including contributing towards Linux. Microsoft is also a key contributor towards an effort to detect child porn.

    I would argue that Microsoft's days of being a security laughing-stock are mostly over. Ever since they released a firewall as part of a Windows XP service pack, I think Microsoft has taken security extremely seriously.

    • Read the report

      The Board finds that this intrusion was preventable and should never have occurred. The Board also concludes that Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations. The Board reaches this conclusion based on
      1. the cascade of Microsoft’s avoidable errors that allowed this intrusion to

    • Ever since they released a firewall as part of a Windows XP service pack, I think Microsoft has taken security extremely seriously.

      That's because you're ignoring everything else about Windows. Arguments which depend on deep ignorance are not compelling.

    • Re: (Score:3)

      by CEC-P ( 10248912 )
      Dude, look at the new Teams and the new Outlook app and tell me that any single person at Microsoft has any idea what they're doing. They do not.

      • Dude, look at the new Teams and the new Outlook app and tell me that any single person at Microsoft has any idea what they're doing. They do not.

        What specifically is bad about the security of those new apps?

    • Re: (Score:2)

      by DarkOx ( 621550 )

      I would disagree.

      Microsoft's relationship to security seems to be as it has always been "yes if it pays the bills."

      The XP/Server 2k3 firewall feature add is an example of something they did because it was an easy band-aide and that really all it was a band-aide on the out and out nightmare (with blaster and sql slammer etc) that their flagship Identity and resource Management solution (Active Directory) and companion technologies were proving to be; at a time when something like Netware or Lotus offerings m

      • "The XP/Server 2k3 firewall feature add is an example of something they did because it was an easy band-aide"

        Not to mention that 2k had IP filtering, so Windows already had a firewall, it just wasn't a featureful one. They only added more features to filtering, they didn't suddenly introduce a firewall.

      • at a time when something like Netware or Lotus offerings might have yet won the business-office-techstack-wars.

        Oh please...

        The XP SP2 / Windows Firewall came out in 2005. Nobody was using Netware at that point; Novell never even put out a formally-for-XP iteration of their Netware client for Windows; firms still using Netware just installed the Windows 2000 version...which was just fine, because Netware had priced themselves out of their own market in comparison to Windows Server's everything-in-a-box solution, especially SBS server that was almost impossible for Netware to compete with.

        Lotus Domino was undoubtedly

    • Re: (Score:2)

      by Bert64 ( 520050 )

      Ever since they released a firewall as part of a Windows XP service pack, I think Microsoft has taken security extremely seriously.

      Having services running by default but inaccessible due to a firewall is pretty braindead, much more sensible to not have listening services running at all unless the user explicitly enables them.

    • A Microsoft researcher pretty much single-handedly just saved the world from the XY backdoor. https://arstechnica.com/securi [arstechnica.com]...

      Let's see what the actual headline of the link is: What we know about the xz Utils backdoor that almost infected the world

      So you got the name wrong. It happens.

      I would argue that Microsoft's days of being a security laughing-stock are mostly over. Ever since they released a firewall as part of a Windows XP service pack, I think Microsoft has taken security extremely seriously.

      I recall those days very clearly. I have also noticed all actions since then. Your argument is hollow and empty. Microsoft does not care about Security, merely the perception of Security. In other words, you have been hoodwinked.

  • You know what would be cool? (Score:3)

    by rsilvergun ( 571051 ) on Wednesday April 03, 2024 @09:33AM (#64366578)
    If Microsoft didn't have such a dominant monopoly that their security defects weren't a national security issue.

  • If you're the freaking US government... Why not build your own rather than rely on Microsoft? National security, right?

    Choose a Linux distro to fork and hire an entire company's worth of geeks to maintain it and the applications you require. Publish it as USGSecure Linux, and hide all sorts of spy stuff in it so anyone of interest using it is vulnerable to your three-letter-agencies.

    • Re: (Score:2)

      by Locutus ( 9039 )
      Maybe something like NSA funded and developed SELinux? Maybe they should have kept developing it and the rest of the government should have considered using it for security sensitive systems. Or all of their systems.
      LoB

    • For the same reason corporate America doesn't use Linux: all it takes is one Windows fanboy near the top to derail the entire project. And in this case "fanboy" includes politicians lobbied by Microsoft, as well as Congress members serving the greater community of Redmond.

      • I assume you're talking about desktop software.

        Linux is kinda the server king these days.

        • Yes.

          These people have the power to detail these projects specifically because there is an "obvious" choice. For the U.S. government, the "obvious" choice is the biggest American software vendor who has been providing similar services to the government for more than a generation. It's easy for someone near the top to start picking apart the non-"obvious" choice, while it's nearly impossible to sell the institution on throwing out what they already use.

          So, in corporate America, there's no ingrained institutio

    • Deliberate insecurity.

      Microsoft was found by the USDoJ to be in violation of basically every kind of antitrust law [wikipedia.org].

      Bush's AG Ashcroft declared that it was not in our country's best interests [justice.gov] to prosecute them.

      Immediately thereafter Gates put his Microsoft fortune into his foundation to avoid taxation [washington.edu]. He has direct it to invest in ways that have enriched him personally and he is now worth more than he was when he founded it.

      At the same time, the next version of Windows and updates to the existing version ma

  • Where the flying [BLEEP] were you 3 decades ago, when their Rube Goldberg OS (Windows) was being drawn up?

  • ... needs to result in an automatic finding of gross negligence. Otherwise nothing will change.

  • What is the actual argument? Email is essentially the most insecure part or aspect of any organization, which puts the requirement to secure it, on the org / person. I know N people will argue me about this, but why the bleep aren't more people using PGP, or other “secure” technology with email?

    People will tell me about DMARC, DKIM, SPF, and all the other patchwork that attempts to secure email, but the issue isn't just who sent it, or where it came from. Outside a secure and protected envi

Slashdot Top Deals

Genius is ten percent inspiration and fifty percent capital gains.

Close