Federal Cyber Experts Thought Microsoft's Cloud Was "a Pile of Shit." They Approved It Anyway.

[Nevilledog]

https://www.propublica.org/article/microsoft-cloud-fedramp-cybersecurity-government


In late 2024, the federal government’s cybersecurity evaluators rendered a troubling verdict on one of Microsoft’s biggest cloud computing offerings.

The tech giant’s “lack of proper detailed security documentation” left reviewers with a “lack of confidence in assessing the system’s overall security posture,” according to an internal government report reviewed by ProPublica.

Or, as one member of the team put it: “The package is a pile of shit.”

For years, reviewers said, Microsoft had tried and failed to fully explain how it protects sensitive information in the cloud as it hops from server to server across the digital terrain. Given that and other unknowns, government experts couldn’t vouch for the technology’s security.

Such judgments would be damning for any company seeking to sell its wares to the U.S. government, but it should have been particularly devastating for Microsoft. The tech giant’s products had been at the heart of two major cybersecurity attacks against the U.S. in three years. In one, Russian hackers exploited a weakness to steal sensitive data from a number of federal agencies, including the National Nuclear Security Administration. In the other, Chinese hackers infiltrated the email accounts of a Cabinet member and other senior government officials.

*snip*

[canetoad]

1. Many people may not know

That to run a Windows computer, contrary to Microsoft's instructions and exhortations, you do not need to sign up for a Microsoft account or utilise cloud storage and/or backup.

The options are very cunningly buried in the OS setup options and it appears to be compulsory. It is not.

[Faux pas]

2. I don't use anything but the basics.

[dickthegrouch]

3. Unless you actively disable a bunch of "options"...

Your system is nowhere close to “secure by design, and secure by default”.
I check all my disabled settings after every patch Tuesday because several mysteriously revert to enabled on a random basis. gpedit.msc on my home edition setup being a prime example of the opposite; it’s regularly disabled again after patch tuesdays and then I can’t disable other settings without it.

[canetoad]

5. Yeah, that's par for the course

Always more extreme after a version upgrade.

[Igel]

4. Yes, No, Maybe.

I loathe MS.

Rather liked MS-DOS.

[canetoad]

6. Still useful

In an emergency.