Approaches to Changing Cybersecurity Culture: Microsoft's Secure Future Initiative Progress Report and Jen Easterly on Responsibility for Quality and Clarity in Cybersecurity

Microsoft is setting the standard (and in many ways the blueprint) for truly building a strong security culture. Remember, culture is the shared attitudes, perceptions and beliefs of your organization. In this case, how invested are people in cybersecurity; do they believe in and prioritize it? Unlike behavior, it takes years to change an organization's culture but it appears Microsoft is committed to making that journey. I highly recommend you take the time to read this report, or if nothing else the summary, as their SFI initiative will be the case studies other organizations will be using for years to come.

Microsoft claims to have dedicated 34,000 full-time engineers to SFI. The report confirms security is a core priority in all employee performance reviews as well as senior executive compensation plans. With luck this prevents recurrence of issues which lead to successful attacks by Chinese and Russian spies.

Many good initiatives, especially nice to see 'integrating cybersecurity performance into the senior leadership team's compensation plans.' Back in 2003 or so, having product managers' compensation impacted by security performance really seemed to put the walk behind the talk after Bill Gates's 2002 'Security is Job 1' all-company email. Don't be fooled, though, by all the big numbers in the report. For example, having the equivalent of 34,000 full time employees focused on security is still only 15% of Microsoft's headcount. Higher than average, but probably not that high for the world's second-largest software vendor who is obviously one of the top attacker targets.

Culture is inculcated over decades. Like quality, it is difficult to patch on. Shipping early in hopes of patching in necessary quality later is fundamental to Microsoft's identity. Getting to doing it "right the first time" from there will be a stretch.

Lack of liability by software vendors is part but not all of the cybersecurity problem we definitely do have. Safer trucks and cars still require driver and mechanic training to stay safe. Well-built bridges require maintenance investments, or they fall down or are knocked down by new, larger, heavier freighter ships that were not well maintained. I have to admit, I would like to see 'Patch Tuesday' called 'Windows Defect Day.'

Finally we are hearing leaders in cybersecurity calling things out as they should be. For too long we have romanticised cybersecurity actors, be they threat actors or defence actors. If we want to be taken seriously by businesspeople, we need to lose the militaristic jargon that is so pervasive in our industry and the trivialising of criminals by giving them cute nicknames - or indeed in the case of one vendor producing action dolls based on threat actor names.

Patching is an inefficient way to achieve necessary quality. Given the numbers, it is not even effective.

A fair point, shifting responsibility, but we must establish some guardrails else the cost to vendors becomes so large that innovation suffers. As far as the comment about changing the language: meh. Instead, we should be focused on reducing software vulnerabilities and automating software updates.

Expect to see continued initiatives requiring secure software out the gate. Expect CISA to require attestations from software providers that they are following secure-by-design processes as part of qualifying their products for government customer

Apple has always been zealous about controlling its product ecosystem, and this simply reflects the tension with security vendors. The question becomes: Are Apple's included security applications sufficient where you don't need third-party security tools? Microsoft is attempting to move in a similar direction.

While tempting to deploy a new OS as soon as the production release is ready, you should have a testing process to verify your security settings, endpoint tools, EDR, scanning, etc. are fully functional. While not definitive, changes to the network stack seem to be a common denominator here. Expect an OS update from Apple in the near future which addresses the issue or provides workarounds.

Interesting to note that LinkedIn did not roll out this feature to their users based in the European Union due to the EU General Data Protection Regulation and the EU AI Act. As an EU citizen it is comforting to know that big tech are legally prevented from abusing and using my personal data without my explicit permission and I do not have to opt out of such data grabs.

The AI data collection was disclosed in LinkedIn's updated terms of service. Most of us missed it. This change means that for the European Economic Area, UK & Switzerland the setting is now off by default, but for the rest of us the AI setting is on. Go to Settings, Data Privacy, Data for Generative AI Improvement, to toggle it on or off. Also consider the setting for Social, economic and workplace research. If you're going to feed your GenAI user data, consider an opt-in model to avoid some privacy concerns.

LinkedIn took a half-step in the right direction. Opt-in vs. opt-out should be the default configuration when it comes to user selection. But, alas, vendors know that most users don't read the fine print and rarely opt out.

A reasonable next step for Telegram. The key is that a valid court order must be presented. Perhaps the change in terms was brought on by recent legal challenges with the CEO, but we'll never really know. In any event, bad actors have been put on notice.

It took a long time, and arguably the arrest of Telegram's CEO to make this happen. It still would not make me trust Telegram as a secure messaging platform.

Telegram has been in the hotseat lately for complicity in the distribution of illegal activities. This, coupled with the activity from the Germany on crypto exchanges, highlight law enforcement's increased awareness of illegal use of services, hopefully putting folks on notice that such activities will be discovered.

In short, the flaw exists in the current and all previous versions of the tinydhcp server. As the code isn't supported, there isn't a wait for new version option, the "workaround" is to use a different dhcp server.

Sadly when it comes to IoT devices, replacing vulnerable services will not be a straightforward task, especially for consumer devices. I predict we are going to see lots of vulnerable devices connected to the Internet over the coming years as many devices won't have their vulnerable services updated until the physical device is itself replaced. Make sure to factor these IoT devices into your corporate vulnerability management program to determine how you reduce your attack surface.

I was opposed to economic protectionism when Europeans used it against our computer industry in the sixties, and I continue to oppose it now. "World Peace through World Trade" works.

This is supply chain security. If approved, software bans don't go into effect for a year to give manufacturers time to verify they are not tied to the PRC or Russia. The hardware ban, which affects things like sensors, Wi-Fi, cellular, Bluetooth, and satellite connectivity, has a longer lead time allowing manufacturers implement other solutions. US-based autonomous vehicles are exempted, but Chineese robotaxi services, such as Nullmax, Pony.ai and WeRide would be affected.

More enforcement of Know Your Customer laws and regulations are needed.

"Know your customer" has always been fundamental to sound banking. While necessary for effective anti-laundering enforcement, it did not originate with it. It is also necessary for sound lending and resisting fraud.

Historically Crypto Exchanges have been tricky to regulate. Hopefully Germany can raise the bar.