Congress Questions Microsoft on Security Failures

Microsoft President Brad Smith appeared before the U.S. House Committee on Homeland Security to address security failures outlined in a recent U.S. Cyber Safety Review Board (CSRB) report. The hearing, titled “A Cascade of Security Failures: Assessing Microsoft Corporation’s Cybersecurity Shortfalls and the Implications for Homeland Security,” scrutinized Microsoft’s security practices following a high-profile incident involving the Chinese hacking group Storm-0558, which compromised Microsoft Exchange Online mailboxes of over 500 people and 22 organizations, including senior U.S. government officials.

In his prepared testimony, Smith accepted responsibility for the security issues and highlighted Microsoft’s efforts to improve security, including the Secure Future Initiative and new security-based compensation for senior executives. Despite these measures, the committee questioned Microsoft’s prioritization of security, given its significant revenue from security products and historical promises to prioritize security over new features.

Smith emphasized the broader geopolitical context, noting the potential collaboration between nations like China, Russia, Iran, and North Korea in cyber warfare. He stressed the need for a collective defense approach, acknowledging that no single company can protect against such threats alone.

The hearing also covered Microsoft’s response to warnings about vulnerabilities, such as those preceding the 2019 SolarWinds attack, and the timeliness of their public disclosures regarding security incidents. Smith’s testimony aimed to reassure lawmakers and the public of Microsoft’s commitment to improving its security culture and practices.

Source: GeekWire

To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.