Microsoft Invests $1 Billion In Holistic Security Strategy

Executives detail strategic and cultural shift at Microsoft to an integrated security approach across its software and services, and announce new managed services group and cyber defense operation center.

Microsoft over the past year invested some $1 billion in security and doubled its number of security executives, and today announced the launch of a new managed security services group and a new cyber defense operations center -- all part of its new strategy of holistic and integrated security across its products and services.
In exclusive interviews with
Dark Reading
, Microsoft executives -- including Microsofts chief information security officer Bret Arsenault -- explained how Microsofts new security strategy is manifested in the companys internal network and across its Windows, Office, and cloud offerings to customers.
Microsoft CEO Satya Nadella today in a keynote address in Washington, D.C., for the first time detailed publicly Microsofts holistic security strategy and how it aims to better protect, detect, and respond to threats, as well as the announcement of its new managed services group and a new security defense operations center. Nadella and his executive team point to the billions of endpoints, services, and systems from which Microsoft draws threat intelligence and then uses that intel for detection, protection, and responding to security events.
The strategy places security at the heart of the software giants products and services, and Microsoft execs described a more integrated protection and intelligence approach that uses the threat intelligence information it gathers worldwide from its sensors and customers. Integrating security across platforms is
a big theme lately with security giants such as Intel/McAfee and Symantec
, which both announced similar strategies last month. Symantecs Advanced Threat Protection platform, for instance, basically integrates and unifies its traditionally separate enterprise security products, and is one of the results of the companys $1 billion investment in R&D under new CEO Michael Brown.
Microsofts $1 billion in security spending this year includes Microsofts organic investments, Microsofts Arsenault says, as well as recent acquisitions. To date, Microsoft has purchased three security firms over the past year including behavioral learning and Active Directory security firm Aorato, cloud security firm Adallom, and most recently,
data and file protection firm Secure Islands
.
Weve always done a good job in caring about writing secure code and making secure services. We needed to do more to protect endpoints and get intelligence from the cloud … so were making investments in a number of areas, Microsofts Arsenault says of the companys strategy.
Nadella in his keynote today said the company has been investing $1 billion in security yearly in security research and development.
Microsoft wouldnt disclose just how many new security executives it has added to the company in the past year, but the execs span its product and operations areas, according to Aresnault. The new managed services arm, Microsoft Enterprise Cybersecurity Group (ECG), focuses on sales and services in nothing but cyber defense, he says. This group will work with Microsofts security partners and the Office 365 and Azure teams, too, for example, he says.
ECG will provide security assessments, monitoring, threat detection, and incident response to Microsoft customers.
The newly unveiled state-of-the-art Cyber Defense Operations Center (CDOC) co-locates members of the companys internal security team, Microsoft Security Response Center, security experts in Azure, Windows, Office 365, security analysts, as well as its Digital Crimes Unit and other groups, for detecting and responding to threats in real-time.
My internal operations team can swivel with … the DCU [Digital Crimes Unit] there, for example, Arsenault says.
Microsoft is incorporating security across the board as part of its products and services as well as its corporate culture. We are making [security] part of everything we do, and will continue to invest in it, he says. That includes security training for every employee, he says.
We made the decision that we should get security as close to the workload as possible, versus its own separate product. We think that goes back to the idea of evolving from one perimeter to perimeterizing everything we do: protect data, devices, and people, he says.
The evolution of Microsofts security posture has been in progress for some time, starting with Windows, so the culmination of the strategy really isnt surprising. But Microsofts very public announcement by its CEO today, as well as word of its new managed services arm, signal a new chapter in Microsofts security story.
That doesnt mean Microsoft is looking to compete with traditional security firms, like it tried with the doomed Forefront family of enterprise security products, however.
Were not a security company like Symantec or McAfee. We are providing end-to-end services for consumers through the enterprise in endpoint, hardware, software, and cloud services. We have a unique position to protect all of those--everything from the endpoint to the way we partner with the ecosystem, he says. We think of ourselves as a security company, but not in the traditional sense.
Windows: Where It All Began
The evolution of Windows security -- via Microsofts Security Development Lifecycle and the roster of new security features Microsoft continues to weave into the OS -- represents a case study in how Microsofts security strategy has emerged.
Dustin Ingalls, general manager of identity and security operations, says the hardware-based security added starting in Windows 8 was the result of a goal to kick the rootkit and bootkit problem. It became clear we couldnt solve that problem in software, Ingalls says.
Windows 10 security centers around three main features, including Device Guard, which vets applications that try to access the machine and its network, and can use hardware and virtualization to handle that process of determination. Windows Hello, touted as a password-killer by Microsoft, relies on a users face, iris, or fingerprint to launch the Windows 10 device. Passport, meanwhile, lets users authenticate to applications, websites, and networks without passwords at all: it verifies that the user has physical access to his or her device and then authenticates them via a PIN or Windows Hello.
My personal mission was to get rid of passwords. Theres nothing we can do today to [truly] secure passwords, Ingalls says. So you have to have something else … we have Passport, which is akin to a smart card, he says, and not susceptible to phishing or key theft since the key is asymmetric. It then uses the Hello biometrics for the second level of strong authentication, he says.
Microsoft also is emphasizing a next-generation endpoint security approach that goes beyond traditional signature-based defenses. We are a lot more focused on using the cloud as an intelligence engine and as a way of being very rapid about how we respond to a threat, Ingalls says. A lot of innovation using machine learning and cloud telemetry to look for unusual behaviors instead of static behavioral detection, he says.
Ingalls says Microsoft will focus more on detonation of threats in the cloud as well, before it hits a users inbox, for example.
Microsofts Rudra Mitra, a partner director who has worked on the security side of Office at Microsoft the past few years and now focuses mainly on Office 365, says having different pieces of Microsofts offerings working in tandem improves security. He says Microsofts work with the security community and partnering with best of breed security partners helps security in a dramatic way.
We are way more now focused on the end-to-end security story, with Windows combined with cloud, Azure, Active Directory, Office 365, and enhanced security services for enterprises like advanced threat analytics, Ingalls says.
Security expert Marc Maiffret says the security of Microsoft software has come a long way since the early 2000s, when Microsoft software was the gateway for attackers to compromise a business.
These days, there are still some Microsoft vulnerabilities clearly that are used to compromise companies but the severity and grade of exploitable ones and the hoops [attackers] have to go through to exploit them has changed things, Maiffret says. Microsoft is no longer that initial front door. Usually, where companies are failing is in how they are architecting and managing their environments: are they doing the proper security design engineering?
Its not just the one-off vuln that ruins your day now, he says. Companies need help managing their environment [security-wise], he says.
ID
Identity is one of the key elements of Microsofts security strategy. Identity is much more important than ever before at Microsoft, says Bharat Shah, CVP of cloud and enterprise security engineering at Microsoft. The waning perimeter adds another element of complexity to strong authentication for organizations.
You will see us making really good progress on the endpoint in cloud security, he says. And we do a lot of on-prem stuff, too.
The Adallom buy gives Microsoft software-as-a-service application log analytics, for example, he says.
Will there be more security-related acquisitions by Microsoft?
We will continue to evaluate what customers demand … and what their needs are, Arsenault says. Our goal is make sure the network, devices, applications, identity are secure, he says.
Maiffret says the string of security acquisitions by Microsoft and how its security strategy has evolved demonstrate that the company is taking to heart securing the whole ecosystem.
Meanwhile, Nadella in his keynote offered a few examples of how security features in Windows 10, Office 365, Azure, and Enterprise Mobility Suite work together to prevent password-related attacks, data loss, and malware. He gave a shoutout to Windows 10s Hello, Passport and Credential Guard security features, for example.
Microsoft also called for companies to take steps to improve their security hygeine.
While there will always be new threats, new attacks, and new technologies, companies can take action today to address security concerns and improve their security postures. It is critical for companies to strengthen their core security hygiene (across things like monitoring, antivirus, patch and operating systems) by adopting modern platforms and comprehensive identity, security and management solutions, and by leveraging features offered within cloud services; and it is just as important to create education and awareness across employee populations in order to build and sustain a pervasive security culture, Microsoft said in a blog post today.

Last News
▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Invests $1 Billion In Holistic Security Strategy