August 5th, 2024

Every Microsoft employee is now being judged on their security work

Microsoft has prioritized security for all employees, affecting performance evaluations, promotions, and bonuses. Employees must integrate security into their work, while the Secure Future Initiative enhances overall security measures.

Read original articleLink Icon
Every Microsoft employee is now being judged on their security work

Microsoft has announced that security will now be a core priority for all employees, impacting their performance evaluations. This decision follows a series of security challenges faced by the company. In an internal memo, Kathleen Hogan, Microsoft's chief people officer, emphasized that security must take precedence over other considerations. Employees will be evaluated on their contributions to security, which will influence promotions, salary increases, and bonuses. The new policy requires employees to demonstrate how they have integrated security into their work processes, particularly in product design and development. Microsoft is also enhancing its security measures through its Secure Future Initiative, which aims to protect its networks and systems. As part of this initiative, Microsoft is making changes to its Outlook services, including ending support for Basic Authentication and requiring Modern Authentication for personal accounts. The company is committed to fostering a security-first mindset among its workforce, ensuring that security is a fundamental aspect of all operations.

- Microsoft has made security a core priority for all employees, affecting performance reviews.

- Employee contributions to security will influence promotions and bonuses.

- The policy requires employees to integrate security into their work processes.

- Microsoft is enhancing security measures through its Secure Future Initiative.

- Changes to Outlook services include ending support for Basic Authentication.

Link Icon 14 comments
By @politelemon - 6 months
This can only be a good thing, as long as it doesn't fall victim to pointless upper management driven metrics (Goodhart's law, "When a measure becomes a target, it ceases to be a good measure"), but qualitative ones instead
By @gwbas1c - 6 months
This reads like it came from Microsoft's security initiative from 20 years ago.

> Microsoft made it clear earlier this year that it was planning to make security its top priority, following years of security issues and mounting criticisms. Starting today, the software giant is now tying its security efforts to employee performance reviews.

Back then, Microsoft held free conferences all over the US to discuss secure programming techniques.

That being said, I've encountered some developers who, because they weren't around 20 years ago, make boneheaded security mistakes. Penalizing developers in performance reviews for (cough) obvious, unprofessional security flaws is rather important.

By @moribvndvs - 6 months
I’ve been in situations where the top announces sweeping, high priority directives to assuage customers and the board, but have no concrete or cohesive plan so they just bounce the problem off the bottom of the hierarchy. It’s called ass covering, and it doesn’t usually work out very well.
By @scj - 6 months
Are features going to be de-prioritized in favour of hardening existing code? Or are employees expected to keep doing what they are doing just "with security in mind"?

The article makes it sound like the later. Which will be about as effective as "thoughts and prayers."

By @rsynnott - 6 months
> Microsoft employees will have to demonstrate how they’ve made impactful security changes.

What if you’re, say, a graphic designer or something? “The Windows 12 default wallpaper is extra-secure”.

By @almatabata - 6 months
Can we get the people judged that allegedly did not prioritize critical security issues properly: https://www.propublica.org/article/microsoft-solarwinds-gold...
By @poikroequ - 6 months
How do they define "security" exactly? Does security include privacy? Will they pull back on all the advertising and tracking they've been forcing upon their users? Will they pull back from injecting AI into everything? How will this affect the backwards compatibility of Windows applications?

It's pointless PR talk without explicitly stating specifics of how this is going to affect their products and services.

By @synicalx - 6 months
I'm kind of surprised this wasn't already a thing. Are we to believe that up until literally today, most employees at MS didn't have to think about security? The same MS who's products and platforms are certified for use in, and also actively used in defence, banking, health etc.
By @ThrowawayB7 - 6 months
Everything old is new again: https://en.wikipedia.org/wiki/Trustworthy_computing But, of course, there's not a peep about TwC in the memo.
By @nhance - 6 months
I have this theory I cannot prove that Microsoft has had an existential level security breach, something like a full access breach to all of Azure, but it is covered up in a "too big to fail" type manner.

I have absolutely no way to prove this gut feeling.

By @ochronus - 6 months
Theatre