Microsoft Secure Future Initiative

Microsoft has come with an announcement of a major new cybersecurity initiative designed to help the company better respond to the increasing speed, scale, and sophistication of today’s cyber-threats.

The Secure Future Initiative has been driven in part by the growing sophistication of state-sponsored actors, in particular the Volt Typhoon campaign targeting US critical infrastructure and the more recent attacks on Microsoft’s cloud services.

On the AI front, the use of technology to improve its threat intelligence and analysis and its  security copilot tool to drive analyst productivity amidst a growing industry skills shortage.This new initiative will bring together every part of Microsoft to advance cybersecurity protection.

Microsoft, in its blog spot, explained three key pillars:

• An evolution of the security development lifecycle (SDL) to the dynamic SDL (dSDL), through automated threat modelling, deployment of CodeQL for code analysis in all commercial products, and expanded use of memory safe languages. Bell said this would help build security in at the language level and eliminate “whole classes” of software vulnerability. A second strand will see the firm enabling more secure defaults, such as Azure tenant baseline controls, to reduce configuration management headaches for customers
• Strengthening identity protection against sophisticated attacks, with consistency across all platforms and products. This includes enforcement of standard identity libraries like Microsoft Authentication Library, and moving identity signing keys to an “integrated, hardened Azure HSM and confidential computing infrastructure”
• Enhanced vulnerability response and security updates, with plans to cut the time taken to mitigate cloud vulnerabilities by 50%

Microsoft will try to combine these AI-driven advances with stronger application of international norms in cyberspacehis will mean trying to encourage governments to accept red lines in cyberspace that they will not cross, and committing not to plant vulnerabilities in critical infrastructure networks.

By automating and using AI in software development, Microsoft can improve the security of its cloud services and reduce the time it takes to fix vulnerabilities. These improvements will directly reduce cyber risks for organizations that use Microsoft’s software and services.