Microsoft Secure Future Initiative Progress Report (September 2024)

Introduction

On September 23, 2024, Microsoft released its latest Secure Future Initiative (SFI) Progress Report, detailing significant strides in addressing the complex and escalating landscape of cyberattacks. The SFI, launched in November 2023, represents Microsoft's large-scale, cross-company commitment to enhancing security. This update emphasizes how their strategic investments, including the allocation of the equivalent of 34,000 full-time engineers, are driving improvements in security culture, governance, and engineering practices across the organization.

Report Overview

The Secure Future Initiative (SFI) was announced in November 2023 by Microsoft as a comprehensive effort to improve the company's security architecture. The initiative aims to reshape how Microsoft builds and maintains its products and services by embedding security into every level of its operations. Since May 2024, security became the top priority, with Satya Nadella, Microsoft’s CEO, integrating security metrics into performance reviews for all employees, making it a company-wide focus.

Key highlights from the report include:

• Identity and Secrets Protection: Microsoft Entra ID and Microsoft Account (MSA) tokens are now signed using Azure Managed Hardware Security Module (HSM), reducing risks associated with key theft and token replay attacks. Moreover, phishing-resistant credentials have been adopted across internal environments, and video-based identity verification was implemented for 95% of users to eliminate password sharing.
• Tenant and System Isolation: A massive cleanup effort resulted in the removal of 5.75 million inactive tenantsand 730,000 unused apps, greatly reducing the attack surface.
• Network Protection: Microsoft secured over 99% of its physical assets on production networks through central inventory and compliance tracking. Service tags have been enforced across all first-party services, adding multiple layers of perimeter security.
• Engineering Systems: Security governance in Microsoft’s engineering environments has been bolstered through centrally managed pipelines for code deployments, reducing inconsistencies and enhancing overall system security.

Insights and Analysis

Microsoft’s dedication to transforming its security culture stands out as a key component of its success. Nadella’s mandate to integrate security performance into senior leadership compensation exemplifies how deeply ingrained security has become within the company’s governance structure. The creation of the Cybersecurity Governance Council, alongside the appointment of Deputy CISOs for critical functions like AI, Azure, and Microsoft 365, further reinforces the comprehensive scope of this initiative.

In conclusion, Microsoft’s Secure Future Initiative sets a precedent for large-scale security transformation across the tech industry. Key preventative measures recommended for organizations looking to improve their own security posture include:

1. Prioritize security in every aspect of development and operations, from identity management to network isolation.
2. Adopt secure-by-design principles, ensuring that security is enforced by default.
3. Implement centralized security logging and monitoring, as demonstrated by Microsoft’s two-year retention policy for audit logs.
4. Provide continuous security training for all employees, fostering a culture of awareness and vigilance.

The Microsoft SFI report serves as a roadmap for organizations aiming to safeguard their infrastructure against the ever-evolving threat landscape.

Indicators of Compromise (IOCs)

MITRE ATT&CK Techniques

References

Progress update on Microsoft’s Secure Future Initiative | Microsoft Security Blog

Read more about the key updates and milestones of Microsoft’s Secure Future Initiative in the September 2024 SFI Progress Report.

Microsoft Security BlogCharlie Bell

https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/SFI_September_2024_progress_report.pdf