Brad Smith of Microsoft Recognizes Previous Security Shortcomings, Unveils Fresh Security Strategies

Brad Smith, the President of Microsoft Corp., addressed a House Committee on Homeland Security hearing today, where he openly admitted to the company’s past security deficiencies. He presented new initiatives aimed at fortifying defenses, in light of a former staff member’s allegations that Microsoft dismissed his alerts regarding vulnerabilities in Active Directory, which eventually contributed to the SolarWinds Worldwide LLC breach in 2020.

While giving his testimony, Smith discussed major breaches such as the SolarWinds hack and the Microsoft Exchange compromise by hackers in 2023, attributing these incidents to numerous breakdowns in Microsoft’s security protocols.

He assured a commitment from Microsoft to prioritize security and outlined the Secure Feature Initiative, designed to safeguard user identities, fortify networks, and segregate production systems to avert similar breaches. Smith highlighted that this initiative is part of Microsoft’s broader plan to enhance threat detection capabilities, accelerate incident response times, and enhance transparency with customers and stakeholders concerning security incidents.

In his submitted written testimony before his in-person testimony, Smith expressed that Microsoft takes full responsibility for all the cited issues in a Cyber Safety Review Report related to the Exchange hack. He pledged to address every recommendation and utilize the report as a cornerstone to reinforce cybersecurity measures comprehensively.

Smith’s admission of Microsoft’s past security lapses coincides with claims made by Andrew Harris, a dissatisfied former Microsoft employee, who stated in an article published by ProPublica that his alerts about security concerns with Microsoft products were disregarded by the company. Smith argued that Microsoft neglected to rectify a critical security flaw in Azure Active Directory Federation Services referred to as “Golden SAML,” which ultimately led to the SolarWinds Breach.

Harris disclosed that he identified the vulnerability in 2016 but was subsequently disregarded by colleagues, and Microsoft failed to address the issue due to the potential financial repercussions of acknowledging the flaw. Harris parted ways with Microsoft in August 2020, and the SolarWinds breach occurred later that same year.

During his testimony, Smith avoided mentioning Harris but assured the committee that Microsoft is dedicated to transparency regarding its security protocols and vulnerabilities. He highlighted the implementation of more rigorous internal audits and external reviews to ensure accountability and continuous enhancement.

Smith emphasized the importance of collaboration among tech firms, government bodies, and other stakeholders to enhance national cybersecurity. He underscored Microsoft’s close cooperation with federal agencies to heighten security measures and exchange vital threat intelligence as it becomes accessible.

Discussing the testimony, Ryan Kalember, Chief Strategy Officer at cybersecurity firm Proofpoint Inc., informed SiliconANGLE that “there have been several significant cybersecurity incidents that impacted consumers’ confidential information, organizations’ Intellectual Property, and sensitive data, as well as governments’ classified intelligence. These incidents may have been preventable if Microsoft had taken different decisions and upheld their public commitments.”

“Security and privacy have regrettably been overlooked in Microsoft’s product design as they pursued new productivity features and a higher stock price, and their recent reversal after the Microsoft Recall AI controversy serves as an enlightening case. Microsoft required extensive pressure from the entire cybersecurity industry and privacy experts to realize the enormity of this easily exploitable security risk and to responsibly disable it by default,” Kalember added.

Not everyone viewed Microsoft’s prior errors as severely, with Jeff Williams, Co-Founder and Chief Technology Officer at application security software platform provider Contrast Security Inc., pointing out that “while it’s evident in hindsight that they committed a mistake, pundits are critiquing them without grasping the full picture.”

“The reality is that software is considerably complex, far beyond most people’s comprehension. A single application is constructed from numerous source code repositories, multiple open-source libraries, various application frameworks, server software, and often diverse language platforms,” Williams elucidated. “Microsoft manages tens of thousands of applications, each of which faces vulnerabilities constantly reported by tools, penetration testers, customers, and others.”

Photo: Web Summit/Flickr

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts