Thread by @_wald0

At a high level, what security-related strategies and policies should Microsoft employ over the next ten years? Here are my ideas, but I want to know what you think as well: 🧵

Number one: take radical ownership over customer security outcomes. Microsoft is already doing this with the introduction of built-in safety rails in Azure. But there’s much more opportunity here:

Historically, Microsoft has made all the tools available to admins to secure their networks: Windows firewall, device guard, application guard, etc. A well-resourced, well-financed admin can make an AD domain *amazingly secure*. But most do not.

There are MANY reasons for this, but only one organization on the planet has the money, talent, and power to make usage of these technologies commonplace: Microsoft. And Microsoft can achieve this by taking radical ownership of customer security outcomes.

Number two: take radical ownership of emergent risks. An emergent risk is an attack primitive, abuse, or class of attack methodology that “emerges” from seemingly disparate components. Take Responder for example.

Responder is capable of performing NBNS/LLMNR poisoning, which can be used to bait authentication from a privileged account, which can be relayed to a system that doesn’t enforce SMB signing.

There are at least three different components here: DNS lookup order, NTLM authentication, and SMB server settings. But there’s also the local admin rights, the lack of inbound or outbound traffic filtering, not to mention the Windows service control manager.

No one team at Microsoft controls all those components, but the organization itself does. This emergent risk (and many others) is *extraordinarily common*.

By taking radical control of emergent risks, I believe Microsoft can eliminate entire classes of attack primitives.

Number three: envision a future where Microsoft platforms and software are universally regarded as the most secure platforms and software to do business on. And then create that future.

Microsoft has had many, very public security-related tumbles (think MS08-067). But it has had several huge security-related accomplishments as well (LAPS, AMSI, etc).

As we look at the next ten, twenty, even thirty years of computing, it’s obvious that cloud computing will play a major part.

I won’t pretend to be an economist or business strategist, but I do know this: customers don’t leave a vendor because another vendor has a better solution - they leave a vendor because the vendor stops taking care of them.

My own experience with Azure so far has led me to this conclusion: there are many lessons learned from the on-prem days, but also many repeated sins.

Chief among those sins is in giving admins enough rope to do their jobs, enough to hang themselves with, but not enough to keep the rope from forming a noose.

Who knows what will happen in the future, but with the dramatically reduced cost in changing cloud platforms when compared to on-prem platforms, Microsoft must take excellent care of its customers in this arena.