3 weeks ago
7
Microsoft’s new Secure Future Initiative (SFI) is starting to take shape with the creation of a Cybersecurity Governance Council led by CISO Igor Tsyganskiy and Deputy CISOs appointed for key security functions and engineering divisions.
The Redmond, Wash. software giant said the council will oversee “the largest cybersecurity engineering effort in history” with the equivalent of 34,000 full-time engineers dedicated to the SFI drive.
Tsyganskiy, who joined Microsoft as global CISO last year, said the new governance council will focus on cyber risk, defense, and compliance.
“The Council prioritizes SFI work, reviews results, and sets SFI’s future direction. The council drives the implementation of regulatory requirements, ensures ongoing compliance, and determines the necessary security architecture,” Tsyganskiy explained.
Each Deputy CISO will oversee specific domains, ranging from gaming and cloud security to artificial intelligence and government systems.
The new Deputy CISOs include former LinkedIn security chief Geoff Belknap who is responsible for M&A, John Lambert for Threat Landscape, and Ann Johnson for a Customer Security Management Office.
Additionally, key engineering divisions like Azure (Mark Russinovich), AI (Yonatan Zunger), and Gaming (Shawn Bowen) have dedicated security leadership
The SFI, which was created in response to an embarrassing US government report on security problems at Redmond, is a top-down mission to make security a core priority for all Microsoft employees, integrated into performance reviews to ensure company-wide commitment.
Advertisement. Scroll to continue reading.
Microsoft said the senior leadership team will conduct reviews of SFI progress weekly, with quarterly updates to the Board of Directors. The company is also tying compensation to security performance.
On the technical side, Microsoft said the SFI has driven significant upgrades across six key pillars — identity and secrets protection, tenant protection and production system isolation, network security, engineering system safeguards, threat monitoring and detection, and incident response and remediation.
Related: Microsoft’s Security Chickens Have Come Home to Roost
Related: Microsoft Bows to Pressure, Disables Controversial Windows Recall
Related: Google Cites ‘Monoculture’ Risks in Response to CSRB Report on Microsoft