Microsoft said it lost weeks of security logs for its customers' cloud products

If you use Azure in any realistic production environments, then it's on you. Even with $100k in free credits, they couldn't convince me to use it for more than a month. It is expensive, the interface is highly user unfriendly and most important of all, their products don't at all seem reliable for production workloads because of stuff like this. Sorry Microsoft, I think you can do much better.

I was laughing recently when at some place they started to install MS software on all Linux machines to integrate them into Azure. At that point you should just stop and think for a while about it. Didn’t you go for Linux because you wanted to have a reliable system?

The MS security software (for better or worse), is better than any open-source linux solution, and can follow attackers as they move laterally through the network, instead of linux servers being a big black hole were adversaries can do as they please.

All security software from any vendor is going to have issues, and often you just have to go with whatever the company is running for the whole environment and not compromising security because of some jokes from the 90s

Please give us details, because this seems unbelievable.

It's just basic EDR .. you have events that are flagged .. so on linux, let's say someone does something like setuid or setgid on a system file. Innocuous but potentially dangerous actions like this get flagged in the system.

These events are correlated against other actions that might have happened on the same system or other systems that the user had logged onto prior to this one.

Even if it's not the same user, the events are still correlated and alerted upon if suspicous. (both individually and holistically)

If users are using microsoft authentication for access, the accounts will be flagged and locked out, generally forcing users to fully authenticate with MFA and forcing a password change.

Microsoft isn't the only company to provide a service like this, and the others are cross platform.

Crowdstrike, for instance :^)

Hey, an outage is better than a hack...right?

A crashed machine is a secure machine.

That’s what grampy used to say