Microsoft Corp. is taking significant steps to enhance its cybersecurity protection measures, aiming to use artificial intelligence (AI) and other advanced methods to bolster its response to vulnerabilities and safeguard its customers. In a blog post, Microsoft executives outlined their commitment to transforming software development, implementing stronger identity protections, and enhancing vulnerability response time.
The company acknowledges the need for a new approach given the ever-increasing speed, complexity, and scale of cyberattacks. Microsoft President Brad Smith emphasized that this comprehensive initiative will involve all aspects of the company to advance cybersecurity protection.
While Microsoft is widely recognized for its software solutions, it has also become a leading provider of cybersecurity products, with this division generating approximately $20 billion annually. However, the company has faced criticism for software vulnerabilities, making it a frequent target for criminal and nation-state hackers.
Earlier this year, Microsoft found itself embroiled in controversies related to major hacks. Hackers exploited a stolen consumer signing key to forge authentication tokens, gaining unauthorized access to user email accounts from around 25 organizations, including US government agencies. The incident prompted criticism from US Senator Ron Wyden, who called for an investigation into the matter.
Amit Yoran, CEO of cybersecurity company Tenable Holdings Inc., also criticized Microsoft for its lack of transparency regarding breaches and vulnerabilities, which exposes its customers to unnecessary risks.
Microsoft's Secure Future Initiative comes as the government encourages software companies to assume greater responsibility for securing their products. The US Securities and Exchange Commission recently filed a lawsuit against SolarWinds Corp., alleging that the company downplayed security risks prior to a major software hack. This highlights the importance of transparency in addressing cybersecurity challenges.
Microsoft aims to build an AI-based cybersecurity shield to protect customers worldwide. AI technology is seen as a game-changer in addressing the significant challenges posed by ubiquitous devices and constant internet connections that generate a vast amount of digital data.
Furthermore, Microsoft plans to employ AI-powered analysis and other measures to extensively audit and secure code against advanced threats. The company will also focus on strengthening identity protection, given the rise in password attacks and hackers' increasing sophistication in stealing and utilizing login credentials. As part of these efforts, Microsoft will migrate to a new and fully automated consumer and enterprise key management system designed to keep keys inaccessible even in the event of underlying process corruption.
Earlier this year, Jen Easterly, the director of the Cybersecurity and Infrastructure Security Agency, urged Microsoft to reclaim the ethos of "trustworthy computing" that company co-founder Bill Gates promoted in 2002. Gates highlighted the importance of prioritizing security in software development. Microsoft recognizes the need to improve and aims to fulfill this responsibility by implementing advanced cybersecurity measures with the help of AI.