微軟的首席信息安全官（CISO）Bret Arsenault在微軟工作了31年，他說他在公司里只有一次得到同事的公開喝彩：那次是廢掉了微軟每71天必須更換密碼的內(nèi)部政策。
微軟的首席信息安全官（CISO）Bret Arsenault在微軟工作了31年，他說他在公司里只有一次得到同事的公開喝彩：那次是廢掉了微軟每71天必須更換密碼的內(nèi)部政策。
"That's the first time I've been applauded as a security person and executive," Arsenault tells ZDNet. "We said we're turning off password rotation within Microsoft, because we had eliminated that part of it."
Arsenault告訴記者，“那次是我第一次作為安全人員和高管被喝彩。當(dāng)時(shí)我們說在微軟內(nèi)部不再需要輪換密碼，因?yàn)槲覀円呀?jīng)取消了這個(gè)做法。”
As Microsoft's CISO, Arsenault is responsible for protecting both Microsoft products and its internal networks used by its 160,000 employees. After adding vendors into the mix, he's responsible for about 240,000 accounts globally. And getting rid of passwords and replacing them with better options like multi-factor authentication (MFA) is high on his to-do list.
Arsenault作為微軟的首席信息官負(fù)責(zé)保護(hù)微軟的產(chǎn)品和旗下16萬名員工使用的內(nèi)部網(wǎng)絡(luò)。他要負(fù)責(zé)連同供應(yīng)商在內(nèi)的全球大約24萬個(gè)賬戶。在他的待辦事項(xiàng)清單上的重要項(xiàng)目里，扔掉密碼、用多因素認(rèn)證（MFA）等更好的選擇來取代密碼的項(xiàng)目排在頭幾位。
Microsoft updated its password policy in stages. In January 2019, it moved to one-year expiry, using telemetry to validate effectiveness. In January, 2020 it moved to unlimited expiry based on the results.
微軟分階段更新了旗下的密碼政策。2019年1月時(shí)，密碼一年過期，利用遙測技術(shù)驗(yàn)證密碼有效性。2020年1月時(shí)，根據(jù)有關(guān)結(jié)果轉(zhuǎn)為密碼無限期有效。
Microsoft also stopped recommending to customers to implement a 60-day password expiration policy in 2019 because people tend to make small alterations to existing passwords or forget new good ones.
微軟還曾在2019年停止向客戶推薦實(shí)施60天的密碼過期政策，因?yàn)橛脩艏幢愀拿艽a也往往只會(huì)對現(xiàn)有的密碼進(jìn)行小的改動(dòng)，或是忘記新的更好的密碼。
For Arsenault, rather than make the conversation about putting MFA everywhere, he framed the change as being about eliminating passwords.
Arsenault沒有把這次談話內(nèi)容定格在將MFA推廣到各個(gè)地方使用，而是將這種改變看成是消除密碼的契機(jī)。
"Because nobody likes passwords. You hate them, users hate them, IT departments hate them. The only people who like passwords are criminals – they love them," he says.
Arsenault表示，“沒有人喜歡密碼。員工討厭密碼，用戶討厭密碼，IT部門討厭密碼。唯一喜歡密碼的人是犯罪分子，只有他們喜歡密碼。”
"I remember we had a motto to get MFA everywhere, in hindsight that was the right security goal but the wrong approach. Make this about the user outcome, so transition to "we want to eliminate passwords". But the words you use matter. It turned out that simple language shift changed the culture and the view of what we were trying to accomplish. More importantly, it changed our design and what we built, like Windows Hello for business," he says.
Arsenault表示，“開始我們有一個(gè)座右銘，就是讓每個(gè)地方都使用MFA，事后來看，這個(gè)安全目標(biāo)是對的，但方法錯(cuò)了。一定要從用戶結(jié)果入手，所以改成‘我們要消滅密碼’。最后的結(jié)果是簡單的語言轉(zhuǎn)變改變了我們的密碼文化以及對于試圖完成目標(biāo)的看法。更重要的是，還改變了設(shè)計(jì)和產(chǎn)品，比如商用Windows Hello。”
"If I eliminate passwords and use any form of biometrics, it's much faster and the experience is so much better."
Arsenault表示，“如果取消了密碼，使用生物識別技術(shù)等技術(shù)，會(huì)快得多，體驗(yàn)也好得多。”
On Windows 10 PCs, that biometric security experience is handled by Windows Hello. On iOS and Android, access to Office apps is done through Microsoft Authenticator, which provides a smooth experience when logging into Microsoft Office apps. It taps into biometrics available on iPhones and Android phones.
Windows 10電腦的這種生物識別安全體驗(yàn)由Windows Hello處理。而在iOS和安卓系統(tǒng)上，訪問Office應(yīng)用程序是通過Microsoft Authenticator（微軟鑒證器）完成的，Microsoft Authenticator為登錄Microsoft Office應(yīng)用程序提供了流暢的體驗(yàn)，使用了iPhone和Android手機(jī)上的生物識別技術(shù)。
"Today, 99.9% of our users don't enter passwords in their environment. That said – progress over perfection – there are still legacy apps that will still prompt [for a password]," he says.
Arsenault表示，“時(shí)下99.9%的用戶不用再輸入密碼。盡管如此，這只是第一步，還不夠完美，還有一些傳統(tǒng)應(yīng)用程序仍然會(huì)提示輸入密碼。”
However, that's not the end of the battle. Just 18% of Microsoft's customers have enabled MFA.
然而，戰(zhàn)斗還沒有結(jié)束。只有18%的微軟客戶啟用了MFA。
This figure seems absurdly low given that enabling MFA is free for Microsoft customers, yet as ransomware shows, there can be mult-imillion dollar consequences when just one key internal account is comprom啟用MFA對微軟客戶來說是免費(fèi)的，所以18%這個(gè)數(shù)字似乎低得離譜，而勒索軟件顯示，泄露一個(gè)關(guān)鍵的內(nèi)部賬戶可能會(huì)有幾百萬美元的后果。
Protecting accounts with MFA won't stop attackers completely, but it does make their lives harder by shielding an organization from the inherent weaknesses in usernames and passwords to protect accounts, which can be phished or compromised through password-spraying attacks.
利用MFA保護(hù)賬戶不會(huì)完全擋住攻擊者，但MFA確實(shí)會(huì)使加大攻擊的難度，MFA使得一個(gè)組織免受用戶名和密碼固有弱點(diǎn)的影響，可以保護(hù)賬戶，利用釣魚或快速猜測密碼等手段則可以攻擊賬戶導(dǎo)致安全泄露。
The latter technique, which relies on password re-use, was one way the SolarWinds attackers breached targets besides breaking into the firm's software build systems to spread a tainted software update.
快速猜測密碼技術(shù)利用了密碼重復(fù)使用的問題，SolarWinds攻擊者黑進(jìn)SolarWinds公司的軟件構(gòu)建系統(tǒng)，得以傳播受污染的軟件的更新入侵目標(biāo)系統(tǒng)，也用到了這種技術(shù)。
Microsoft is moving towards a hybrid mode of work and, to support that shift, it's making a push towards a Zero Trust network design, which assumes the network has been breached, that the network extends beyond the corporate firewall, and caters to BYOD devices that could be used at home for work or at work for personal communications.
目前，微軟正在轉(zhuǎn)向混合工作模式，為了支持該轉(zhuǎn)變，微軟正在推動(dòng)零信任網(wǎng)絡(luò)設(shè)計(jì)的使用，零信任網(wǎng)絡(luò)假定網(wǎng)絡(luò)已經(jīng)被入侵，網(wǎng)絡(luò)延伸到了企業(yè)防火墻的外面并可以方便個(gè)人通信BYOD設(shè)備的使用，這解決了可能在家里用工作環(huán)境網(wǎng)絡(luò)或在工作環(huán)境用家庭網(wǎng)絡(luò)的問題。
But how do we get more organizations to enable MFA in critical enterprise products from Microsoft, Google, Oracle, SAP and other crucial software vendors?
但我們要如何才能在更多的組織中對微軟、谷歌、甲骨文、SAP和其他關(guān)鍵軟件供應(yīng)商等眾多關(guān)鍵企業(yè)產(chǎn)品上啟用MFA呢？
For organizations looking to enable MFA, Arsenault recommends targeting high-risk accounts first and to work on progress rather than perfection. The biggest problem is legacy applications, but seeking perfection risks getting bogged down.
對于那些希望啟用MFA的組織，Arsenault建議首先的目標(biāo)是高風(fēng)險(xiǎn)賬戶，要努力取得進(jìn)展，而不是追求完美。最大的問題是傳統(tǒng)應(yīng)用程序，但追求完美有可能陷入困境。
"Everyone has brownfield apps that can't support modern authentication, such as biometrics, and so I think what a lot of people should and need to do is take a risk-based approach: first get MFA enforced for high-risk/value groups like admins, HR, legal group and so on, and then move to all users. It can be a multi-year journey, depending how quickly you want to do something," he says.
Arsenault表示，“每個(gè)人都有些舊應(yīng)用程序不能支持諸如生物識別技術(shù)的現(xiàn)代認(rèn)證，因此我認(rèn)為很多人應(yīng)該而且需要做的是采取基于風(fēng)險(xiǎn)的方法：首先在高風(fēng)險(xiǎn)價(jià)值群體里實(shí)施MFA，例如管理員、人力資源、法律小組等群體，然后再轉(zhuǎn)向所有用戶。這可能是一個(gè)數(shù)年的旅程，這取決于想多快完成。”
Then there's the difficult question about SolarWinds and how Microsoft, which has a $10 billion cybersecurity business, got caught out by Russian government hackers. Microsoft in February claimed it was only minimally harmed by the incident, but it was nonetheless breached. Microsoft president Brad Smith called the hack a "moment of reckoning" because customers, including Microsoft itself, can no longer trust the software they get from trusted vendors.
同時(shí)也有一個(gè)難題，SolarWinds以及俄羅斯政府黑客盯上了擁有100億美元網(wǎng)絡(luò)安全業(yè)務(wù)的微軟。微軟在2月份曾稱在這次事件中只受到了很小的傷害，但卻還是被入侵了。微軟總裁Brad Smith稱這次黑客攻擊是個(gè)“認(rèn)識真相的時(shí)刻”，包括微軟在內(nèi)的客戶不能再信任從可信供應(yīng)商那里得到的軟件。
"Certainly, we used SolarWinds Software in our environment and we identified and remediated the impacted versions and we've been public about that there was access. We continue to modify how we do supply chain programs and how we evaluate what's in supply chain and how quickly we can go do those things," says Arsenault.
Arsenault表示，“當(dāng)然，在我們的環(huán)境里使用SolarWinds軟件，找到并修復(fù)了受影響的版本，并已經(jīng)公開了有關(guān)的信息。通過也在繼續(xù)修改供應(yīng)鏈的計(jì)劃以及如何評估供應(yīng)鏈里的內(nèi)容。”
According to Arsenault, Microsoft had seen the supply chain threat coming for a long time.
根據(jù)Arsenault表示，微軟很早就看到供應(yīng)鏈威脅的出現(xiàn)。
"You see a lot of people doing stuff to protect their front doors, but then their backdoors are wide open," he says.Arsenault表示，“大家看到很多人都在做保護(hù)自己的事情，但他們的后門卻大開。”
"The part we've seen coming along is that the supply chain is the weak point, right. You have limited visibility into your suppliers. I think [US president Joe Biden's] executive order will help in this space. But getting to the view of how we think about suppliers, we need a way to get that visibility in a scalable way.
Arsenault稱，“我們已經(jīng)看到的部分，供應(yīng)鏈?zhǔn)莻�(gè)薄弱環(huán)節(jié)。供應(yīng)商的可見度有限。而美國總統(tǒng)喬-拜登的行政命令在這個(gè)領(lǐng)域?qū)?huì)有所幫助。但從供應(yīng)商的角度而言，我們需要一種可擴(kuò)展性的方法來提高這種可見度。”
"I want to take the Zero Trust concept for information workers and apply that to the software supply chain, which is no line of code that was ever written wasn't from an attested identity, from a healthy device," he says.
Arsenault表示，“微軟想把信息工作者的零信任概念應(yīng)用到軟件供應(yīng)鏈上，即是說，任何一行編寫的代碼無不來自經(jīng)過認(rèn)證的身份，無不來自健康的設(shè)備。”
第12期 2021/07/15
