Learn Satya Nadella’s Microsoft cheat sheet on the right way to put safety first

In the present day I wish to speak about one thing essential for the way forward for our firm: placing security first.

Microsoft depends on belief, and our success is dependent upon incomes and sustaining it. We’ve got a novel alternative and duty to create the most secure and most dependable platform for innovation on this planet.

Current findings by the Division of Homeland Safety’s Cybersecurity Evaluation Board (CSRB) relating to the Storm-0558 cyberattack that occurred in the summertime of 2023 underscore the severity of the threats going through our firm and our prospects, in addition to our duty to guard in opposition to these rising threats. subtle risk actors.

With this duty in thoughts, we launched our Safe Future Initiative (SFI) final November, bringing collectively all components of the corporate to enhance cybersecurity protections in each new merchandise and legacy infrastructure. I’m happy with this initiative and grateful for the work that went into making it occur. However we should and can do extra.

Going ahead, we are going to transition our total group to SFI as we redouble our help for this initiative utilizing an method based mostly on three core rules:

• Security by Design: Security comes first when designing any services or products.

• Safety by Default: Safety is enabled and utilized by default, with no further effort or requirement.

• Safe Operations: Safety measures and monitoring might be frequently improved to handle present and future threats.

These rules will information each side of our SFI core rules as we: shield private knowledge and secrets and techniques, shield tenants and isolate manufacturing techniques, safe networks, shield utility techniques, monitor and detect threats, and speed up response and remediation. We have outlined the particular company-wide actions that every of those pillars will entail, together with these really useful within the CSRB report, which you’ll be able to examine right here. At Microsoft, we are going to mobilize to implement and implement these requirements, pointers and necessities, and this might be a further side of our hiring and compensation selections. As well as, we are going to implement accountability by basing a portion of senior administration compensation on our progress in opposition to our security plans and benchmarks.

We should method this problem with each technical and operational rigor and a deal with steady enchancment. Each activity we tackle—from a line of code to a consumer or companion course of—is a chance to assist strengthen our personal safety and the safety of our total ecosystem. This contains studying from our opponents and rising the problem of their capabilities, as we did with Midnight Blizzard. And we study from the trillions of distinctive alerts that we consistently monitor to strengthen our total place. It additionally entails nearer and extra structured collaboration between the private and non-private sectors.

Safety is a crew sport, and accelerating SFI is not only the primary precedence for our safety groups, it’s everybody’s high precedence and our prospects’ biggest want.

If you’re confronted with a alternative between safety and one other precedence, your reply is evident: Guarantee security. In some circumstances, this may imply prioritizing safety over different issues we do, reminiscent of releasing new options or offering ongoing help for legacy techniques. That is key to enhancing the standard and capabilities of our platform so we will shield our prospects’ digital property and construct a safer world for everybody.

Satya