Tech giant Microsoft says it will drastically improve its cybersecurity practices to assuage the public concerns of multiple experts, especially in the wake of its increased AI ambitions.
"In recent months, we’ve concluded within Microsoft that the increasing speed, scale, and sophistication of cyberattacks call for a new response," wrote VP and president Brad Smith in a new blog.
"Therefore, we’re launching today across the company a new initiative to pursue our next generation of cybersecurity protection – what we’re calling our Secure Future Initiative (SFI)."
The new programme will include an AI-based cyber shield, developed based on experiences learned from the war in Ukraine, he said, as well as better multifactor authentication (MFA) out-of-the-box for Microsoft customers.
Rumours of unrest have been rumbling since as late May, when Microsoft announced that it had detected Chinese nation-state hackers hiding out in US government computer networks, as well as spying on information being transmitted via email and through the cloud by a large number of US businesses.
Microsoft knew because it provides Azure cloud services to the US government and these businesses. In the industry, it’s known as a “vendor”, while everyone who pays for its services is a “customer”.
The tech giant said it had already notified all affected customers, but fearing that the Chinese hackers could be up to more dastardly activities, Microsoft said it had decided to warn the rest of the tech industry to be on the lookout.
However, the trouble didn't stop there. Numerous cybersecurity researchers, both independent and firms, have called Microsoft out privately and publicly over the summer for failing to patch sofware vulnerabilities that they discovered in a timely manner.
And cybersecurity firms who do not wish to be named have told The Standard that they have struggled to help their clients pick up the pieces after a cyberattack occurs, because their clients are all running Microsoft cloud products.
Trouble behind closed doors
The three biggest cloud providers in the world are Microsoft, Amazon Web Services (AWS) and Google Cloud. They are known as “vendors”, meaning that they built the technology that makes the cloud work, and they sell space on their cloud platforms to millions of customer companies that would like to show you something on the internet.
Microsoft’s Azure Cloud alone is used by many popular brands you know of, like Samsung, LG, eBay, Pixar, Coca-Cola, Bosch and Xerox, as well as many others you might not know, but are important behind the scenes to keep the internet running smoothly.
So if hackers manage to get into the cloud, then they can steal information relating to consumers from a vast array of online services, right around the globe.
On 27 July, US Senator Ron Wyden sent a letter to the US Department of Justice (DoJ), the US Federal Trade Commission (FTC) and the US Cybersecurity and Infrastructure Security Agency (CISA). In it, he blames Microsoft for the Chinese espionage campaign and asking the regulators to hold the tech giant accountable for its “negligent cybersecurity practices”.
Since then, CISA has called out Microsoft about its allegedly unsafe software practices several times this year. In September, Microsoft announced that it would finally be providing all customers free access to their cloud-security logs, which many in the tech industry believe is due to pressure from CISA.
Pushing ahead with AI
However, Microsoft has reiterated that it is indeed pushing ahead with AI use in its products.
"One reason these AI advances are so important is because of their ability to address one of the world’s most pressing cybersecurity challenges. Ubiquitous devices and constant internet connections have created a vast sea of digital data, making it more difficult to detect cyberattacks," wrote Mr Smith.
He said that in any single day, Microsoft receives more than 65 trillion signals from devices and services around the world.
"Even if all eight billion people on the planet could look together for evidence of cyberattacks, we could never keep up," he added.
"But AI is a game changer. While threat actors seek to hide their threats like a needle in a vast haystack of data, AI increasingly makes it possible to find the right needle even in a sea of needles. And coupled with a global network of data-centres, we are determined to use AI to detect threats at a speed that is as fast as the Internet itself."
