Developers Are Imperfect, and Cybersecurity Is Unforgiving
Discover Microsoft's cybersecurity insights from the Storm-0558 incident. Learn how to navigate developer mistakes and secure microservices effectively for a resilient system.
Microsoft released its findings from its investigation into the Storm-0558 incident. I read the post, but I’d be lying if I said I learned much of anything that was useful to me. The security work that Microsoft is doing is on such a different scale to almost every other company in the world that it makes it very hard to relate to. I can understand what they’re talking about, but I’ve not done anything like it myself.
There was one part that stood out, though. That section read:
Developers in the mail system incorrectly assumed libraries performed complete validation and did not add the required issuer/scope validation. Thus, the mail system would accept a request for enterprise email using a security token signed with the consumer key (this issue has been corrected using the updated libraries).
This stands out because it highlights a problem that all companies face. Two things are true:
1. Developers make a ton of mistakes, and
2. Making mistakes with authentication and authorization has serious consequences.
These two facts don’t play well together, as Microsoft discovered.
This isn’t an earth shattering discovery, but it does affect how we should think about the security of the systems we build.
Securing Microservices
If you go down the rabbit hole of microservices, as so many of us have, you might be tempted to think about authentication and authorization as services themselves. You split authentication and authorization into APIs, and get your other services to call them.
If that is all you do, you will quickly start to get nervous. What if the other services are using these APIs incorrectly? So, you also make a nice client library that each service can use. Now, all a service has to do is import the client library and call the right function, and everything will work as it should.
But life isn’t that simple. Each service needs the latest version of the client library, first of all. And while “calling the right function” sounds easy, each service also needs to call that function at the right time. It also needs to handle the response, including any errors, appropriately.
There is nothing inherently wrong with this approach to securing your systems, and in certain contexts it might even be the best decision. However, it is vulnerable to the conflict mentioned at the start of this post: developers make mistakes, and mistakes in this area are costly. Every service is still a potential security risk, and every developer has the opportunity to mess it all up.
Keeping Services Internal
An alternative approach is to minimize the number of services that are exposed to end users. The goal is to ensure that the majority of applications can’t compromise your security even if they’re written by a clown.
Say you have thirty different microservices. You might have an API proxy that sits in front of them, but instead of having that API proxy call directly to each, you instead only give it access to two or three services that sit on top. Those services then handle authentication and authorization, do business logic stuff, and use the rest of the services as internal helpers of sorts.
As a result, the responsibility for handling authentication and authorization is on those two or three services alone, not the twenty or thirty services you have created internally. It also means that far fewer developers need to be right for this to work.
Of course, this approach has its tradeoffs, but that’s always the case. There is no perfect solution. However, what I like about this is that it acknowledges the reality that developers make mistakes, and keeps as many developers away from security-critical situations as possible.
No matter how you choose to design your systems, you should at least have thought about this problem. Think about how many developers need to be “right” in order to avoid catastrophic security flaws, and try to minimize that number where you can. If you are doing that, you’re at least headed in the right direction.
We believe in a learn-by-doing approach over snooze-worthy videos.
Instead, Pistachio tailors real-world scenarios so your team can build their cyber skills in a safe environment.
Continue reading
Ready to reduce your human risk? Book your demo today.
“We lacked confidence that employees would recognise today’s phishing threats or respond correctly. Since using the Pistachio platform, they are more attentive and proactive in identifying potential risks. The solution is easy to manage, quick to implement, and highly effective.
“The platform is easy to implement and provides clear insights into employee phishing awareness. Its bite-sized learning encourages participation, saves administration time, and allows us to focus more on real threat detection.”
“We were looking for a practical way to improve cybersecurity awareness across the organization. Pistachio made training simple and engaging, and we’ve seen a noticeable improvement in employee awareness with minimal effort.”
“Pistachio removed the burden of planning campaigns, collecting data, and evaluating results. The program challenges each employee at their own level and provides clear, simple reporting. Pistachio has streamlined our awareness training and strengthened our organization’s cybersecurity.”
“Our goal was to help employees better recognize phishing emails and avoid malicious links. Pistachio made this easy and engaging, and we’ve seen a clear improvement in detection, fewer clicks on phishing links, and reduced data disclosure. With minimal ongoing maintenance, it’s an effective and low-effort solution.”
“Within weeks, Presence had flagged several incidents that could have otherwise been missed, including employees forwarding company data to personal accounts during offboarding. The alerts are reliable and actionable, so we've built a full investigation process around them. Although I was skeptical at first, the value was obvious almost immediately.”
“Pistachio has reduced our manual workload to zero with its automated phishing simulations and in‑box delivery of scenario‑based trainings. This has allowed our team to dedicate time to other important security initiatives while Pistachio handles our Security Awareness program seamlessly.”
“Presence automatically detects suspicious behaviour and gives us the visibility we need without constant manual oversight. Within the first few weeks we were already seeing alerts that would have otherwise gone unnoticed as the system learns what is usual and unusual behaviour for our environment.”
“Before Pistachio, security awareness was something we could only offer to a few customers. Today it’s part of every managed service we deliver, and we haven’t had to grow the team to make that happen.”
Fill out the form to book a demo:
Trusted by 1200+ customers & MSPs
