back to article Microsoft says tougher punishments needed for state-sponsored cybercriminals

Microsoft is calling for more robust deterrents to be placed on nation-states as criminals continue to run rife across online systems "without any meaningful consequences." However, like those consequences, Microsoft's recommendations contained in its annual cybersecurity report - published today - lack specificity, and thus …

  1. Mishak Silver badge

    First thing to do

    Make companies responsible for any exploitable defects in their products.

    Followed by requiring them to release security updates for the service lives of their products (i.e. not just the marketing life).

    1. Khaptain Silver badge

      Re: First thing to do

      Isn't that exactly what caused the explosion of everything now using subscriptions ?

  2. Anonymous Coward
    Anonymous Coward

    Usual MS pile of shite

    Unusually it's not software this time.

  3. Rgen

    MS created the problem. Now they want everybody to pay for it.

  4. Pascal Monett Silver badge
    Mushroom

    Oh, so it's the government's responsability now ?

    Fine.

    As the government, I would lock up the CEO until the shit got sorted out.

    How do you like that idea ?

    You want me to be responsible ? I will responsibly go after the idiots who created this shitstorm in the first place. Your product is responsible for 99% of the Internet's problems.

    You're first in line for my "responsibility".

    1. Eclectic Man Silver badge

      Re: Oh, so it's the government's responsability now ?

      Well, actually, "cybersecurity is everyone's responsibility,"

      Although, now I see it written down, I seem to recall hearing something like that before, at my former employer, and the one before them, of course, and the one before them too.

      In the absence of any likelihood that state-sponsored hackers will be either caught or subject to the law in any country whose IT they hack, the only viable responses are better security (you didn't hear that here first, I hope). Of course, finding out who they are, where they are and what they are doing will help, but, as the article notes, without any prospect of arrest or trial, tougher penalties in law might not make much of a difference.

  5. Brewster's Angle Grinder Silver badge

    Government: "You want us to bear responsibility? In that case, here's all the regulations we'll insist upon you complying with. And don't complain - you asked for it."

  6. Doctor Syntax Silver badge

    "Economic sanctions are a lever allied nations love to pull when it comes to imposing costs on malign states, yet Microsoft seemed unwilling or unable to offer any substantial ideas for building on these."

    Firewalls?

  7. Omnipresent Silver badge

    You guys do realize

    M$ is a publicly traded company, and are probably (more or less) owned by foreign entities now right?

    Obviously, russia and n korea and iran are able to get into any computer they want at anytime. Especially, with valuable information being thrown around in the hands of people who couldn't care less! It can be bought from criminals if nothing else.

    Further more, Open Ai and the others are all part of "the bros". These are stupid rich agents of the enemies of America: who are influencing, and disrupting, and destroying everything they touch with complete intent (I wonder why)?

    Not that they care! Because, if you want to start to clean house, you are going to have to do it internally first! You ARE the bad guys.

  8. Howard Sway Silver badge

    This includes a company-wide adoption of secure-by-design

    The problem here is that secure-by-design needs to be adopted before you write your operating system, not after you've written it.

    1. DoContra
      Thumb Up

      Re: This includes a company-wide adoption of secure-by-design

      And if you start after you've written it, you need to own up and break compatibility with programs that require/"exploit" said unsafe designs, even if backwards compatibility is your main selling point.

    2. Omnipresent Silver badge

      Re: This includes a company-wide adoption of secure-by-design

      Indeed. The problem is, one operating system cannot do it all. It cannot be omnipresent by design. We need smaller, more specialized OS's that manage more specific needs. An over arching OS is asking for devastation on a global scale.

      An enterprise system should be focussed on being compatible over many systems.

      A Personal computer OS should be focussed on privacy.

      A workstation should be focussed on productivity.

      There is room for all. What we have now is a complete disaster, and epic fail, done by very evil people hobnobbing with other very evil people for personal gain. They do not give one iota about you or your needs.

      1. rw.aldum

        Re: This includes a company-wide adoption of secure-by-design

        Personal OS and Privacy? But how will copilot record and store everything you do on all your devices for “recall to function” without all these exploits, I mean features, that have been added into the core OS over decades. We can’t possibly live with stripped down windows. How will everyone and their dog know to sign up for a 365 subscription after every windows update and be reminded to set Edge as their default browser.

        No… these security “issues” are by design, for profit, data hogging features.

  9. Paul Hovnanian Silver badge

    Don't hold your breath

    "Russia, Iran, and North Korea are the main guilty parties here"

    I'm sure Russia, Iran and North Korea will be extraditing the guilty parties posthaste. Yeah, right.

    Failing any substantive action on the issue, we could always push an update to BGP to make their national networks disappear from the global Internet. At least they'll have trouble hacking something they can't reach.

    1. Like a badger Silver badge

      Re: Don't hold your breath

      Perhaps about time that Western government examined the companies that enable payment transfers to the bad actors (or the transfer of stolen funds), and went after insurers who pay out ransomware insurance, as well as the C-suite dorks that allow their companies to be attacked as a result of underinvestment or lack of will in the area of IT security. And nail the big IT companies knackers to a plank over their use of licence agreements to evade fitness for purpose laws. Treat software as a product, not a bit of "intellectual property", and apply product laws to it, that's wipe the smile of Big Tech's smug face.

      Hell, I can't even see a lawyer about writing a will or employment rights without providing proof of identity "to stop money laundering", but when it comes to the big companies of the banking and payments systems it seems that it's not really about interrupting criminal activity, merely a self-sustaining system of regulators and sometimes compliant financial services companies.

    2. Guy de Loimbard Silver badge

      Re: Don't hold your breath

      100%, this is just posturing really isn't it?

      These countries in the spotlight aren't going to handover anyone just because Uncle Sam says so!

  10. Anonymous Coward
    Anonymous Coward

    The single most effective cybersecurity policy in history is "Break up Microsoft and Intel in the 1990s and prevent their shareholders from associating with each other for life."

    If we didn't want to do this then we don't really want cybersecurity anyway.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like