The goal of any Business Continuity program should be to create and maintain operational resiliency. As Phil and Traci mentioned, our program at Microsoft is holistic – meaning that it looks at process resiliency across a broad range of dependencies both internal (workforce, other teams) and external (vendors, supply chain).

One key to our program’s success is having strong commitment and support across the business. Program credibility is enhanced with high level direction from our Board, funding commitments from our business leaders and best-in-class subject matter experts. Our program is further strengthened with tight integration and common goals with our internal audit and enterprise risk teams.

Traci and Phil also talked about the importance of standards. First, standards create a common taxonomy that works across the company which is essential if your organization is global and in multiple lines of business. We also find business continuity standards, such as the federal PS Prep (Private Sector Preparation) voluntary standards could, potentially, become a requirement for vendors selling to the US government. Organizations can theoretically save compliance costs by aligning to these forthcoming standards sooner than later.

One other aspect of our program is an emphasis on vendor resiliency. Outsourcing has become an increasingly popular strategy for companies to reduce costs and focus on core business functions. While these strategies can deliver on their promise, they also introduce new business continuity risks. Companies should not mistake the transfer of risk to an outsourcing vendor with operational risk reduction. A proactive procurement system that includes business continuity risks coupled with systematic vendor assessment and joint exercise commitments can help mitigate much of this unseen risk.

Lastly, a tough economic environment puts new pressure on the tools issue. Centralizing data captured through implementation of a BCM program provides an opportunity to create new information assets. Companies have a choice of investing in a specialized tool that can manage workflows and can create structure for organizations or they can create their own control environment internally without having to pay licensing, training or customization fees.

At Microsoft, we use our own tools to gather data, create workflow and enhance communications. We find that most folks appreciate the ease of use in a familiar interface such as the Microsoft Office Suite as well as the fact that these tools don’t require additional licensing fees.

-Tom Easthope
Senior Program Manager, Enterprise Business Continuity
Microsoft Information Security

Anil Revuru (RV) from the IST (Information Security Tools) team in his recent blog discusses how Web Protection Library v1.0 (WPL) Security Runtime Engine (SRE) has been significantly updated. RV walks you through how to configure WPL SRE. Also in his video “Using the Web Protection Library (WPL) - CTP Version” he talks about the expansion of the Anti-XSS Library and introduces mitigation for other attacks including: SQL injection, cross-site request forgery (CSRF) and setting enforcement like SSL & HTTP_ONLY cookies to name a few. Additionally apart of this A&P suite, RV discusses the assessment tools including the Code Analysis Tool for .NET (CAT.NET) and Web Application Configuration Analyzer (WACA). Check out his blog “How to Run CAT.NET 2.0 CTP”  as he goes over the installation and configuration details of CAT.NET v2.0. You can also view his “Using Web Application Configuration Analyzer (WACA) - CTP Version” where shows how to configure the verification tool.

The CTP (Community Technology Preview) is available in Microsoft Connect – Information Security Tools.

Read CTP announcement and follow the IST Team blog for the latest on the A&P suite and other security tools.

-Todd

The A&P Suite includes:

Protection Tools:

• Web Protection Library (WPL) will act as an umbrella for several libraries and runtime modules which include:
  • Anti-XSS - The Microsoft Anti-Cross Site Scripting Library v3.1 (Anti-XSS V3.1) is an encoding library designed to help developers protect their ASP.NET web-based applications from XSS attacks.
  • SRE – Packaged together with Anti-XSS when downloaded. Helps prevent XSS and SQL injection attacks, but instead of having to make changes to the code (which is manual and costly), a user makes changes to the application configuration and not the code (white list/black list).

You can get more details on WPL as Anil Revuru (RV) in his video, “Enhanced Web Protection Library” discusses the expansion of what used to be the Anti-XSS Library. 

Assessment Tools:

• Code Analysis Tool for .NET (CAT.NET) is a managed code security source code scanning tool. This has been totally rewritten.
• Web Application Configuration Analyzer (WACA) designed to scan your development environment against best practices for .NET security configuration, IIS settings, SQL Server Security best practices and some Windows permission settings.

A&P Suite overview:

To download these tools for free, you will need to register on the Connect site. Once you’ve registered, you can download the tools below directly. Get the latest on the A&P Suite on the IST Blog.

Download, A&P Suite will include:

CAT.NET 2.0 CTP

WPL 1.0 CTP

WACA 1.0 CTP

-Todd

In Microsoft IT (MSIT), we have a formal program known as the First & Best Program. This program, , drives end to end IT support for all products, MSIT intends to deploy and provide support for in our production environment. Sometimes we start dogfooding products years before a product is even released to market. Generally only major product releases are on-boarded to the program. Some examples are Windows, Exchange, SQL, SharePoint, Forefront and more.

InfoSec is a key participant in the First and Best program with two overall specific goals –

1. Ensure all dogfood deployments are secure and compliant with policy

2. Assess, strategize and trial the product’s security features in advance of a production implementation

Once a product is ready to go through the security portion of the First & Best program, here’s what takes place:

1. ACE Team performs a security design review. Closely working with the key product owners, ACE will begin a triage to evaluate the MSIT deployment plan focusing on all in-scope features to determine security risk and ensure policy compliance as well as security operations business continuance. Ultimately, ACE will give an approval when all concerns are addressed.

2. Security Operations Planning and Strategy Team will conduct an assessment through spec reviews and deep meetings with the product groups, focusing on security features only. Risk reduction opportunities are identified and summarized in a document that seeds shared goal development and testing.

3. InfoSec Operations pre-production team will drive the rollout and testing of the security features. During this stage, any bug, design change requests as well as general product feedback are produced and managed as part of the overall dogfood effort.  

In the coming weeks we’ll be discussing each phase in more detail. Stay tuned.  In the mean time, check out my recent video Microsoft Information Security & Dogfooding, I walk you through our dogfooding process and share our successes. 

-Mark Smith
Senior Security Program Manager
Microsoft Information Security

-Todd

For more information on this application other security tools, visit the Information Security Tools Blog.

-Todd

Download the latest Anti-XSS Library v3.1. Learn more about this library and other information security tools on the IST blog.

-Todd

Along with this release of CISF, we’re also releasing our first custom application using CISF called Risk Tracker version 1.0 which captures and tracks high level security risks through manual input and via direct feeds from upstream systems (application provisioning and security review scheduling). Watch the video, “Risk Tracker: Reducing Risks at Microsoft,” as Sarah Pickard, Senior Security Program Manager from Microsoft Information Security team and Mark Curphey, Product Unit Manager from Microsoft Information Security Tools (IST) team discuss Risk Tracker, the new custom information security application built on CISF. They share how the business will use the application and how it will manage risk.

Challenges

Similar to other companies, to support our evolving business needs we continue to develop custom applications to address business requirements. At the end of the day, we end up with a portfolio of different applications. Eventually we want to move toward the approach of building solutions where all applications can work well together on one framework. Having one framework allows us to build many applications on top of each other.

In information security at an enterprise, there are many different risks to track. Our risk management team expressed a business need for one simple, central system that has the ability to: 1) identify risk 2) log risk 3) measure risk and 4) track risk. Ultimately we needed a risk management system that lets us effectively reduce risk at Microsoft. To address this need the IST team built Risk Tracker, our first custom application using CISF.

Solution

With our one framework approach, CISF is a development framework made up of reusable components specifically designed to create custom security tools that are highly specialized, change frequently and are usually highly unique to specific scenarios or businesses. These tools are often those where the requirements are emerging and are expected to change rapidly as the emerging business problem becomes better understood. Companies can use and extend the framework to create new applications, port their current custom applications to use it, update existing applications to consume framework services like controls and either use or extend sample applications we create, for instance, Risk Tracker.

Risk Tracker is the first custom sample application and the start of more applications built on CISF. This application will help organizations manage, track, report, associate, as well as assign risk to an entity. Eventually this system will allow us to develop a plan and tag milestones to ultimately see how we’ve reduced risk over time for Microsoft.

Business Value

CISF

Building applications on one framework, CISF provides the following business values to an enterprise:

• The framework provides software developers the ability to create and connect a wide array of disparate information security related data, systems and business processes into a common software architecture.
• Custom applications can be integrated together with one core business infrastructure, connecting to the same data sources.
• Security controls service can be consumed by humans and tools.
• The framework can provide a central customized reporting and analytics.

Risk Tracker

Using one risk management system can be valuable to a business, below describes some business values for the Risk Tracker application:

• Having one central system, all risks can be consolidated into one central repository for easy tracking and reporting, also providing a tracking change history made by the user or the system.
• Deadlines can be driven without human intervention through streamline notifications.
• Risk Tracker can help drive accountability to risk managers, ensuring that risks are addressed in a timely fashion.
• Using one system to consolidate risks, Risk Tracker can provide organizations visibility to the “high” impact risks where time and resources can be prioritized effectively.

Vision

CISF is a big project spanning over several years. Initially we will be releasing a CTP (Community Technology Preview); providing quarterly code drops, as we add more functionality and re-factor the existing framework driven from what we learn from our user feedback. We’re building this framework for ourselves, testing it within Microsoft, but we want other Microsoft customers to share in our work and partner with us. We want to hear from people that are interested in this framework and share with us ideas and feedback--we’ll be setting up some user groups to hear and share technical details. Risk Tracker is our first custom application on CISF, we hope it will be the beginning of many more applications. The vision for Risk Tracker, we eventually want the system to help us predict risk based on historical data which ultimately lends to effective risk planning and mitigation.

Download

Both CISF and Risk Tracker will be released open source on CodePlex using an MS-PL license, essentially meaning our customers and ISV’s can take the code and use it as they see fit. The IST team will be providing quarterly releases and updates for CISF.

CISF CTP download

Risk Tracker v1.0 download

Stay up to date on the latest news by visiting the IST blog.

-Todd

There are 5 key learning areas that we’ve looked to optimize in Awareness:

1. Simple, Precise & Actionable Messaging

This is one of those things that I feel is true not only for security but for any point that you’re trying to make in any context. There are always a lot of things going on in any large enterprise like Microsoft and to ensure people pick up on your message, we have to keep the message simple, precise and actionable. Doing campaigns around large nebulous concepts like “secure your application” isn’t always as effective as driving the message of “Use AntiXSS to protect against Cross-Site Scripting attacks”. The former is a large domain with lots of controls that can be thrown in and the latter is a very precise and actionable message. Granted that you may have to create a lot of simple and precise messages to cover the complete concept of secure applications, but in the long run, it turned out a lot more effective for us.

2. Awareness Activities: Marketing, Evangelizing or Educating?

One of the things we realized over the course of driving awareness programs and campaigns is that there are really 3 different types of activities that we were undertaking. We were either trying to:

1. Market something
2. Evangelize something
3. Educate people on a specific topic (which was more often the case)

The need for these 3 different types of approaches was born out of our understanding of driving simple, precise and actionable messages. When we started reducing our messages down, we saw that we either needed to market, evangelize or educate.

There are times when you just want to drive some mini-marketing around a shiny new tool you’ve released like CAT.NET. And then there are times when you want to evangelize a new policy, an upcoming tool like TAM 3.0 (which is now released by the way) or the importance of design reviews. And then of course there is the most common case where you are trying to provide prescriptive education to the end user, like defending against specific SQL injection attacks.

In each of the 3 cases, you are driving awareness of something. It turns out that it was helpful for us to understand the type of activity we wanted to drive in order to ensure we are producing the most optimal resource type.

3. Persistence & Innovation

Security awareness really does come down to changing behavior and changing behavior requires a lot of persistence. We would drive campaigns to promote certain security activity and you would see a spike in that activity but over time it would phase out. We learned the need to not only persist our messaging but also to keep it fresh and innovative. If we just recycle old messages and campaigns, it doesn’t land as effectively as freshening up the delivery a bit with perhaps new incentives or new mediums of delivery.

4. Integrating into the Environment

Clearly we’re in an incredibly fast paced environment and it’s getting increasingly difficult to get someone’s attention. So rather than trying to capture people’s attention so we can tell them about a new security practice or tool or some piece of education, it helped us to identify outlets where individuals are gathering (in person or virtually). We would then seed our message into these outlets. This approach of taking the message to the people rather than forcing the individuals to come to our message turned out very effective in reaching a larger audience with lesser effort (not necessarily a new concept as it’s very much marketing 101 but nonetheless a good learning for us early on in Awareness). Some examples include:

• Getting important security messages into team all-hands meetings
• Publishing best practices or links to security tools into various team or discipline focused publications/newsletters
• Having booths at corporate events

One important lesson for us in seeding content was to ensure that we are contextualizing the message. For example, it would do little good to seed the importance of secure development practices into an all-hands meeting for call center teams that deal with taking customer’s credit cards and have virtually no developers.

5. Measuring Success

This is perhaps one of the most important learning that we continue to experience: just how exactly do you measure the precise success of an awareness initiative (or information security initiatives in general!). If awareness is about behaviors changes and most people agree that behavior changes can take long time to achieve, how do you show incremental results from your campaign? This is where we stuck to basics and saw that it’s important to measure our engagement level and our effectiveness.

The engagement level came down to understanding how many individuals we are able to engage with our programs and campaigns and how much it cost us. The engagement type could be passive or active. For instance, passive engagement could entail someone just visiting a web page that talks about certain security controls or best practices. An active engagement, on the other hand, could be when someone decides to participate in a training or survey on that web page. On top of engagement type, we measure cost per engagement which gives us a nice benchmark to understand the ROI from a budgetary perspective. If it cost us $1,000 to reach 100 individuals, how can we improve that further. This exercise, more than anything else, was vital in understanding the high-investment-low-return activities in our campaigns and potentially cutting them out. An example is print. Typically the most costly element of a traditional awareness campaign is posters and other print material which costs quite a bit to produce only to return minimal results and end up at the bottom of the recycle bin.

The effectiveness was important for us to understand whether what we are trying to message is relevant to the target audience. This was a bit trickier to measure but we again stuck to a simple approach. We would drive things like “spot-the-bug” contests to understand if certain classes of bugs are still not understood well by a certain developer population or seed surveys with questions to the likes of “did you know about X prior to this campaign?”.

As simple as these approaches may sound, not only do they help us reaffirm whether the message we’re driving is relevant but they also give us data points that we can then track over months or quarters or years to trend how effective is our specific program or campaign while simultaneously optimizing them for impact.

Much like our overall information security program, there is definitely room for improvement and we continue to learn from our experiences. Yet I’m very proud of the progress we’re making on different fronts like Awareness as just one of our overall effort in driving a holistic people, process & technology solutions for information security.

As always, would love to continue to hear your thoughts.

-Todd

Socialize

At the core of our framework is the concept of socializing security. In simple terms, what this foundation means to us is that we will look to transcend organizational boundaries of information security and help connect people with people that can facilitate in the process of managing information security risk. So it’s not just about formal mandatory courses that you have to sit through, pointing people to policies and standards that need to be interpreted or throwing nebulous tasks at the user (e.g., “protect confidential data”) without perspective and contextual guidance. Instead, it’s really all about trying to engage in a dialogue, understand the pain-points of the customer and laying clear, concise and actionable controls (guidance, tools, etc.) in front of the users. Some of the mechanics we have employed include:

1. Conducting podcasts with security and non-security SMEs to discuss emerging risks, new controls or other thoughts from the information security and business landscape.
2. Drive positive reinforcement by recognizing and showcasing individuals that go above and beyond their duty to support the mission of information security.
3. Socialize people’s thoughts (good and bad) on information security to help maintain a level of awareness for information security.
4. Focus on providing clear, concise and actionable guidance and/or tools to users.

Localize

With this core foundation established, the next step up in the framework is the acknowledgement of the locale or context in which we want to deliver a message. Microsoft is an incredible diverse place and our ability to leverage this diversity is critical to effective messaging. What this means is that we need to take into account the business and/or geography where we are conducting the awareness. Some examples include:

1. Recognizing the need to localize the content into local language for some regions in an effort to ensure effective consumption of message.
2. Recognizing the security baseline of different organizations and teams which means certain teams may require Security 101 type messaging (e.g., Why is it important classify data?) while other more security mature organizations may need details on specific controls (e.g., How do I go about segmenting my vendors from my full-time employees on my network properties?).
3. Understand team priorities and culture so you can better position your message. Some examples of this include teams with a strong culture of innovation where you want to ensure you are not in any way looking to impose too much structure (e.g., Forcing individuals to take some 4 hour training before they can use a tool) that impedes the organic nature of innovation. Contrast that to a team with a strong operational focus where it may be perfectly fine to impose 4 hour training but we need to ensure we are making this training part of the yearly training cycle for that team.

With our core foundations of socializing and localizing security messages established, we turn our focus to the specifics.

Risk

Every message we develop as part of a single deliverable or a larger campaign has to be aligned back to an information security risk that we are trying to manage.

Resources

Over the foundation of socializing and localizing our message, we look to determine the best form of resources that we can develop that individuals can consume with the intent of managing information security risk. Is it a checklist of To Do’s? Is it a tool we need to get developed and pushed out with the help of our Information Security Tools team? Is it an ACE service offering we need to position from our Information Security Assessment team? Is it a training we need to develop? An important aspect of developing the resource is trying to make it fun. For example, you can setup little quizzes to test security knowledge or have spot-the-bug competitions for developers to identify security bugs, etc. A fun little game tied to an incentive can be a powerful delivery mechanism for a message you want to land.

Incentive

This is an important and often overlooked element of an awareness campaigns. What is the incentive to the individual for wanting to consume and act on your message? There are two categories of incentives and it really goes back to the stick versus carrot approach: do you want to negatively incentivize someone or positively incentivize someone? I don’t believe it’s a matter of wrong or right approach but rather a question of what’s more effective given a situation. I have my views on what I believe to be a more effective and scalable approach in terms of information security in general but a case can be made when you need to negatively incentivize against a behaviors change (i.e., if you don’t comply with this, you could lose your job) – this discussion does often times get into regulations and right now, I’m not willing to touch that topic with a 10 foot pole! :-)

Here are some examples of positive incentives:

1. Establish individual developer’s commitments to write code with 0 security bugs. At the same time, have the training and educational modules ready for the developers to consume. This puts the positive incentive (tied back to their bonus!) on the developer to do the right thing and aligns them your resources to help them with the task.
2. Setup fun little games (spot-the-bug, etc.) or quizzes to “Test your Security IQ” with simple drawings to give out prizes for randomly chosen or most active participants of the game.
3. Establish rewards and recognitions to showcase and exemplify positive security behavior by individuals.

Whenever possible, I highly discourage negative incentives for awareness. Granted they may be needed in certain situations but in the long term, they only add to the perception that security is an obstacle to business and not an enabler. The most common example of negative incentives I’ve seen others talk about beyond citing the fact that policy violation can lead to termination of employment is making examples of and showcasing individuals that we reprimanded for violating policy.

So this is our framework. It all boils down to making sure people are aware of security and going about their business securely, every time and all the time. Microsoft, like a lot of companies, is a culture of hard working and passionate individuals. Collectively they help define a crucial element of the overall organization security posture so we have to make sure they are all thinking about and acting secure, one individual at a time.

In my next post, I’m going to discuss some of our key learning: what’s working, what’s not working and what are some of the new tactics we’re looking to employ in Awareness.

-Todd