News

23332 readers

2930 users here now

Welcome to the News community!

Rules:

1. Be civil

Attack the argument, not the person. No racism/sexism/bigotry. Good faith argumentation only. This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban. Do not respond to rule-breaking content; report it and move on.

2. All posts should contain a source (url) that is as reliable and unbiased as possible and must only contain one link.

Obvious right or left wing sources will be removed at the mods discretion. We have an actively updated blocklist, which you can see here: https://lemmy.world/post/2246130 if you feel like any website is missing, contact the mods. Supporting links can be added in comments or posted seperately but not to the post body.

3. No bots, spam or self-promotion.

Only approved bots, which follow the guidelines for bots set by the instance, are allowed.

4. Post titles should be the same as the article used as source.

Posts which titles don’t match the source won’t be removed, but the autoMod will notify you, and if your title misrepresents the original article, the post will be deleted. If the site changed their headline, the bot might still contact you, just ignore it, we won’t delete your post.

5. Only recent news is allowed.

Posts must be news from the most recent 30 days.

6. All posts must be news articles.

No opinion pieces, Listicles, editorials or celebrity gossip is allowed. All posts will be judged on a case-by-case basis.

7. No duplicate posts.

If a source you used was already posted by someone else, the autoMod will leave a message. Please remove your post if the autoMod is correct. If the post that matches your post is very old, we refer you to rule 5.

8. Misinformation is prohibited.

Misinformation / propaganda is strictly prohibited. Any comment or post containing or linking to misinformation will be removed. If you feel that your post has been removed in error, credible sources must be provided.

9. No link shorteners.

The auto mod will contact you if a link shortener is detected, please delete your post if they are right.

10. Don't copy entire article in your post body

For copyright reasons, you are not allowed to copy an entire article into your post body. This is an instance wide rule, that is strictly enforced in this community.

founded 1 year ago

MODERATORS

[email protected]

164

Scathing federal report rips Microsoft for shoddy security, insincerity in response to Chinese hack (apnews.com)

submitted 7 months ago by [email protected] to c/[email protected]

17 comments fedilink hide all child comments

In a scathing indictment of Microsoft corporate security and transparency, a Biden administration-appointed review board issued a report Tuesday saying “a cascade of errors” by the tech giant let state-backed Chinese cyber operators break into email accounts of senior U.S. officials including Commerce Secretary Gina Raimondo.

The Cyber Safety Review Board, created in 2021 by executive order, describes shoddy cybersecurity practices, a lax corporate culture and a lack of sincerity about the company’s knowledge of the targeted breach, which affected multiple U.S. agencies that deal with China.

It concluded that “Microsoft’s security culture was inadequate and requires an overhaul” given the company’s ubiquity and critical role in the global technology ecosystem. Microsoft products “underpin essential services that support national security, the foundations of our economy, and public health and safety.”

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 17 points 7 months ago

During my time contracting in the FedGov, they went "all in" on Microsoft products. From email to Teams to other products, they were becoming a Microsoft shop top to bottom. This was fine for products which were fully mature. For all the jokes about it, Microsoft email is actually pretty good. Azure AD is fine, as long as you have a team of sysadmins to unfuck permissions issues. Permissions will get fucked, as there is a dearth of tools for mapping them. But, that's been a perennial problem with AD permissions well back to the NT 4.0 days (maybe longer, I was dealing with Novell before that). And there isn't much better for centralized user management than AD, though third party PAM tools do help here, a lot. Their security tools were (and still are) shit on toast from a usage perspective. Seriously, the only reason people choose MS Defender anything is because "no one ever got fired for choosing ~IBM~ Microsoft".

The main problem is that Microsoft is a "for profit" company. This means that there will always be tension between Security and Profit. So, it's unsurprising that they have a lax security culture. Security isn't profitable. The appearance of security is, and I have little doubt Microsoft will be able to roll out all kinds of documentation showing that they were "compliant" with all the required security controls. This means exactly dick, as it's easy to have insecure systems be "fully compliant" and then do exactly fuck all to actually secure the systems. "Compliant" is a baseline and only proves that you're not going to get hacked within the first ten minutes of plugging a network cable in. Actually securing the system means a lot of people, processes and efforts finding and fixing holes not covered by the baselines and watching the network for anomalies. That's really expensive and makes ITs job a pain a lot of times. It also makes no money, as it doesn't do much to enhance the appearance of security, so it tends to get ignored and eventually cut. The end result is exactly what we have here today, a major hack which didn't get picked up on for weeks.