Microsoft launches Secure Future Initiative to bolster security

Strengthening identity

The second SFI advancement is a new identity system, currently in development, that is designed to help users improve verification and authentication protocols across the entirety of Microsoft's platform and products.

"Our goal is to make it even harder for identity-focused espionage and criminal operators to impersonate users," Bell, Jha and Guthrie wrote.

In September, Microsoft revealed that a threat group it refers to as Storm-0558 stole a Microsoft account signing key by compromising a Microsoft engineer's account. Using the compromised account, the China-based threat actor gained access to Microsoft's corporate network and found that the key was accidentally placed in a debugging environment -- another mistake by Microsoft.

Storm-0558 used the stolen key to breach the email accounts of several customer organizations, including some federal government agencies. Following the attacks, Microsoft was also criticized for its inadequate logging features, which it has since addressed.

SFI specifically addresses the security of such keys. "To stay ahead of bad actors, we are moving identity signing keys to an integrated, hardened Azure HSM and confidential computing infrastructure. In this architecture, signing keys are not only encrypted at rest and in transit, but also during computational processes as well. Key rotation will also be automated allowing high-frequency key replacement with no potential for human access, whatsoever," Bell, Jha and Guthrie wrote.

In his blog post, Smith said password attacks have "increased ten-fold during the past year." Microsoft's goal is to make consumer and enterprise key management fully automated through a unified and consistent process, he said, adding that the advancements will be made freely available to non-Microsoft application developers.

Cloud vulnerability management

The third and final component of Microsoft's SFI outlines proposed improvements to cloud vulnerability responses and security updates. To that end, one of the biggest promises Microsoft made was reducing the time it takes to mitigate cloud vulnerabilities by 50%. Security researchers have called out Microsoft for silently patching and downplaying vulnerabilities discovered in its cloud services. Last year, Tenable criticized Microsoft for its lack of transparency around cloud flaws after reporting Azure vulnerabilities to the software giant.

"We also will encourage more transparent reporting in a more consistent manner across the tech sector," Smith wrote.

Dustin Childs, head of threat awareness at Trend Micro's Zero Day Initiative, said SFI could mark a significant moment for Microsoft, comparable to founder Bill Gates' Trustworthy Computing (TwC) memo from 2002.

"I especially like that they included vulnerability response as a tenet, but I am concerned the focus seems to be specifically for cloud computing," Childs said. "There are still plenty of on-prem software and services that are favorites of attackers. We saw vulnerability response take a hit in 2014 when the original TwC [group] was disbanded. Let's hope they've learned from that and don't make the same mistakes."

Microsoft will look to investments in automation, orchestration and intelligence-driven tools to achieve the third advancement of improving cloud vulnerability mitigation.

The expansion of AI capabilities was another aspect of Microsoft's SFI. Smith referred to AI as a game changer for threat hunting, especially during a time when remote work and an influx of unmanaged BYOD created even more attack vectors.

"In a single day, Microsoft receives more than 65 trillion signals from devices and services around the world. Even if all 8 billion people on the planet could look together for evidence of cyberattacks, we could never keep up," he said.

When the initiatives are enacted, Microsoft will extend its Microsoft Threat Intelligence and Microsoft Threat Analysis Center directly to customers. In addition, AI will be used to help enterprises address trends such as the cybersecurity workforce shortage and the rise in ransomware attacks.

Microsoft told TechTarget Editorial that the initiatives are driven by Microsoft AI, but efforts such as Security Copilot will include third-party partners such as OpenAI.

Additional reporting by senior security news writer Alex Culafi.

Arielle Waldman is a Boston-based reporter covering enterprise security news.