{"id":138308,"date":"2025-04-17T09:00:00","date_gmt":"2025-04-17T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=138308"},"modified":"2025-04-17T08:14:50","modified_gmt":"2025-04-17T15:14:50","slug":"microsofts-secure-by-design-journey-one-year-of-success","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/04\/17\/microsofts-secure-by-design-journey-one-year-of-success\/","title":{"rendered":"Microsoft’s Secure by Design journey: One year of success"},"content":{"rendered":"\n
Cybersecurity is one of the top risks facing businesses. Organizations are struggling to navigate the ever-evolving cyberthreat landscape in which 600 million identity attacks are carried out daily.1<\/sup> The median time for a cyberattacker to access private data from phishing is 1 hour and 12 minutes, and nation-state cyberattacks are on the rise.2<\/sup> Organizations also face unprecedented complexity, making security jobs harder\u201457% of organizations are using more than 40 security tools, which requires significant resourcing and effort to integrate workflows and data.3<\/sup> These challenges are magnified by the global security talent shortage organizations are facing and there are more than 4 million security jobs unfilled worldwide, rising insider risks, and the rapidly evolving regulatory landscape today.4<\/sup> These cybersecurity challenges can not only increase significant business disruptions, they can also create devastating economic damages\u2014the cost of cybercrime is expected to grow at 15% year over year, reaching $15.6 trillion by 2029.5<\/sup>\u00a0<\/p>\n\n\n\n In November 2023, to address the evolution of the digital and regulatory landscape, and the unprecedented changes in the cyberthreat landscape, we announced the Microsoft Secure Future Initiative<\/a>. The Secure Future Initiative (SFI)\u00a0is\u00a0a\u00a0multiyear\u00a0effort\u00a0to\u00a0revolutionize the way we design, build, test, and operate our products and services, to achieve the highest security standards. SFI is our commitment to improve Microsoft\u2019s security posture, thereby improving the security posture of all our customers, and to work with governments and industry to improve the security posture of the entire ecosystem.<\/p>\n\n\n Last year, the Cybersecurity and Infrastructure Security Agency (CISA), through its “Secure by Design” pledge<\/a>, called on the technology industry to prioritize security at every stage of product development and deployment. This approach of embedding cybersecurity in digital delivery from the outset is also reflected in the United Kingdom\u2019s Government’s Cyber Security Strategy as well as in the Australian Cyber Security Centre (ACSC)\u2019s \u201cEssential Eight\u201d mitigation strategies to protect against cyberthreats. Throughout this blog post, the term \u201cSecure by Design\u201d encompasses both \u201csecure by design\u201d and \u201csecure by default.\u201d<\/p>\n\n\n\n Microsoft committed to work towards key goals across a spectrum of Secure by Design principles<\/a> advocated by numerous government agencies around the world. These goals aim to enhance security outcomes for customers by embedding robust cybersecurity practices throughout the product lifecycle. We continue to take our learnings, feed them back into our security standards, and operationalize these learnings as paved paths that can enable secure design and operations at scale. Our SFI updates provide examples of Microsoft\u2019s progress in implementing secure by design, secure by default, and secure in operations principles, and provide best practices based on Microsoft\u2019s own experience, demonstrating our dedication to improving security for customers.<\/p>\n\n\n\n Keep reading to learn about the initiatives Microsoft has undertaken over the past 18 months to support secure by design objectives as part of our SFI initiative. It is organized around our SFI principles to provide our customers and partners with an understanding of the robust security measures we are implementing to safeguard their digital environments.<\/p>\n\n\n\n Phishing-resistant multifactor authentication provides the most robust defense against password-based cyberattacks, including credential stuffing and password theft. This includes promoting multifactor authentication among customers, implementing it as a default requirement for access, and participating in efforts to establish long-term standards in authentication.<\/p>\n\n\n\n In October 2024, Microsoft implemented mandatory multifactor authentication<\/a> for the Microsoft Azure portal, Microsoft Entra admin center, and Microsoft Intune admin center. Since then, Microsoft has worked with our customers to reduce extensions and rapidly advance multifactor authentication adoption. A key achievement is our progress in eliminating passwords across products. Microsoft has introduced enhancements to streamline authentication<\/a> and improve sign-in experiences, emphasizing usability and security. Users can now remove passwords from their accounts and use passkeys instead, addressing vulnerabilities and preventing unauthorized access. <\/p>\n\n\n\n On March 26, 2025, Microsoft launched a new sign-in experience for more than 1 billion users. By the end of April 2025, most Microsoft account users will see updated sign-in and sign-up user experience flows for web and mobile apps. This new user experience is optimized for a passwordless and passkey-first experience. Microsoft is also updating the account sign-in logic to make passkey the default sign-in choice whenever possible.<\/p>\n\n\n\n Additional examples of Microsoft improving authentication and how customers can learn from Microsoft\u2019s approach and solutions include:<\/p>\n\n\n\n Most exploited vulnerabilities today stem from types that can often be mitigated on a large scale, such as SQL injection, cross-site scripting, and memory safety language vulnerabilities. Governments aim to reduce these by encouraging companies to adopt practices like eliminating authorization validation logic mistakes, enabling the use of memory-safe languages, creating secure firmware architectures, and implementing secure administrative protections. The goal is to minimize exploitation risks by addressing systemic vulnerabilities at their root.<\/p>\n\n\n\n Our introduction of mandatory use of the Microsoft Authentication Library<\/a> (MSAL) across all Microsoft applications helps ensure that advanced identity defenses, such as token binding, continuous access evaluation, and advanced application attack detections, are consistently implemented. This standardizes secure authentication processes, making it significantly harder for attackers to exploit identity-related vulnerabilities. MSAL enables developers to acquire security tokens from the Microsoft identity platform to authenticate users and access secured web APIs.\u00a0<\/p>\n\n\n\n Microsoft is also committed to adopting memory-safe languages, such as Rust, for developing new products and transitioning existing ones. This approach addresses common vulnerabilities related to memory safety. Microsoft is investing heavily into safe language to enhance the safety of our code, and we are applying this new approach to our security platform and other key areas like Microsoft Surface and Pluton security firmware.\u00a0\u00a0\u00a0<\/p>\n\n\n\n In Windows 11, we\u2019ve applied a secure by design strategy from the very first line of code. We have established a Hardware Security Baseline, which helps to ensure every Windows 11 PC has consistent hardware security forming a secure foundation. Windows 11<\/a> has secure by default settings and stronger controls for what apps and drivers are allowed to run. This is important as unverified apps and drivers lead to malware and script attacks. And most malware and ransomware apps are unsigned, which means they can be authored and distributed without being provably safe. For consumers and smaller organizations, Smart App Control<\/a> <\/strong>is a new feature that uses cloud AI to enable millions of known safe apps to run, regardless of where you got them. For larger organizations, <\/strong>IT admins can layer on App Control for Business policies<\/a> and\u00a0deploy them using Intune.\u00a0\u00a0<\/p>\n\n\n\n With Windows powering business critical solutions across a wide variety of customers, we are committed to helping ensure that Windows remains the most secure and reliable platform. At Microsoft Ignite in 2024, we announced the Windows Resilience Initiative<\/a> focused on enhancing the security and resilience of the Windows operating system. This involves implementing advanced security features, improving threat detection and response capabilities, and to help ensure that Windows can withstand and recover from cyberattacks. As part of the Windows Resilience Initiative,\u00a0we are working to protect against common cyberattacks in addition to strengthening identity protection mentioned above.\u00a0\u00a0<\/p>\n\n\n\n As part of this we are addressing the long-standing challenge of overprivileged users and applications, which create significant risk. Yet many people do not want to give up admin control of their PC. To help strike the balance of admin privileges and security we are introducing Administrator protection<\/strong><\/a> <\/strong>(currently in Windows Insiders). Admin protection gives you the protection of standard user permissions by default<\/strong>, and when needed you can securely authorize a just-in-time system change using Windows Hello. Once the process has completed, the temporary admin token is destroyed. This means admin privileges do not persist.\u00a0 Admin protection will be disruptive to cyberattackers, as they no longer have elevated privileges by default, which will help organizations\u202fensure they remain in control of Windows.\u00a0<\/p>\n\n\n\n We are also collaborating with endpoint security partners to adopt safe deployment practices. This means all security product updates will be gradual, minimizing deployment risks and monitoring to help ensure any negative impact is kept to a minimum. Additionally, we are developing new Windows capabilities that allow security product developers to build their products outside of kernel mode, reducing the impact to Windows in the event of a security product crash.\u00a0<\/p>\n\n\n\n Another key development is our secure by design user experience (UX) toolkit<\/a>. Human error causes the majority of security breaches. The UX toolkit helps build more secure software and improve user security experiences. This toolkit represents a new way of thinking\u2014where design and security aren\u2019t siloed but are working together from the very beginning. Adopted internally and shared externally, the toolkit helps other software organizations in enhancing their security practices.<\/p>\n\n\n\n Other activities Microsoft has worked on to eliminate classes of vulnerabilities include:<\/p>\n\n\n\n Timely and effective patch management is necessary for cybersecurity, as this is how we can reduce the window of opportunity for malicious actors to exploit software flaws.<\/p>\n\n\n\n Microsoft has made measurable increases in the installation of security patches, which we achieved by enabling automatic installation of software patches when possible and enabling this functionality by default, as well as by offering widespread support for these patches.<\/p>\n\n\n\n Microsoft continues to roll out major security updates on the second Tuesday of each month, known as Patch Tuesday. This regular schedule ensures that all systems receive timely updates to address critical vulnerabilities, thereby reducing the risk of exploitation by cyberattackers.<\/p>\n\n\n\n Building on this foundation, Microsoft has made significant strides in improving the update process with Windows 11. By reducing the number of required system restarts from 12 to four per year through the use of Hotpatch updates, we have further streamlined operations and encouraged organizations to remain compliant with patching requirements.<\/p>\n\n\n\n Other examples of our efforts in to boost patch and security update rates include:<\/p>\n\n\n\n Coordinated vulnerability disclosure, a practice Microsoft adopted more than a decade ago, benefits both security researchers and software manufacturers by enabling collaboration to enhance product security. A VDP that authorizes public testing of products, commits to refraining from legal action against those who follow the VDP in good faith, provides a clear channel for reporting vulnerabilities, and permits public disclosure of vulnerabilities according to coordinated vulnerability disclosure best practices and international standards makes a real difference for cybersecurity. Additionally, manufacturers can demonstrate transparency by including accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields in every CVE record for the manufacturer\u2019s products.<\/p>\n\n\n\n Our adoption of the CWE<\/a> and CPE standards in every CVE record for its products is an important achievement. This transparency facilitates accurate and detailed information about vulnerabilities, facilitating timely and effective remediation. By issuing CVEs promptly for all critical or high-impact vulnerabilities, Microsoft demonstrates its commitment to maintaining a secure environment and protecting its customers from potential cyberthreats.<\/p>\n\n\n\n Another notable highlight is the publication of a machine-readable CSAF files<\/a>, which provide a clear channel for reporting vulnerabilities and authorizes public testing of Microsoft products. This fosters collaboration between security researchers and software manufacturers, enabling the identification and mitigation of vulnerabilities in a coordinated manner.<\/p>\n\n\n\n Other activities Microsoft has worked on to adopt VDP and CVE include:<\/p>\n\n\n\n Organizations should do more to detect cybersecurity incidents and understand their impact. To ensure they can do that, manufacturers should provide artifacts and evidence-gathering tools, like audit logs.<\/p>\n\n\n\n An example of Microsoft\u2019s commitment in this area is our implementation of robust sensors and logs, enhancing detection of cyberthreats. This initiative provides customers with actionable insights into potential intrusions, enabling swift responses and risk mitigation.<\/p>\n\n\n\n Other activities Microsoft has worked on to empower customers to detect and document inclusions include:<\/p>\n\n\n\n GitHub shipped enhanced capabilities to the GitHub audit log to provide customers with increased visibility of API events<\/a> and features to enable enterprise management, automation, and integration<\/a>.<\/p>\n\n\n\n To learn more about Microsoft Security solutions, visit our website.<\/a> Bookmark the Security blog<\/a> to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security<\/a>) and X (@MSFTSecurity<\/a>) for the latest news and updates on cybersecurity.<\/p>\n\n\n\n 1<\/sup>Microsoft Digital Defense Report 2024<\/a>.<\/p>\n\n\n\n 2<\/sup>Microsoft Digital Defense Report 2022<\/a>.<\/p>\n\n\n\n 3<\/sup>IDC North America Tools and Vendors Consolidation Survey<\/a>, 2023.<\/p>\n\n\n\n 4<\/sup>2024 ISC2 Cybersecurity Workforce Study<\/a>.<\/p>\n\n\n\n<\/figure>\n\n\n\n
Enhancing security with multifactor authentication and default password management<\/h2>\n\n\n\n
\n
Reducing entire classes of vulnerabilities<\/h2>\n\n\n\n
\n
Boosting patch application rates<\/h2>\n\n\n\n
\n
Adopting a Vulnerability Disclosure Policy (VDP) and Common Vulnerabilities and Exposures (CVE) <\/h2>\n\n\n\n
\n
Empowering customers to detect and document intrusions<\/h2>\n\n\n\n
\n
\n\n\n\n