Securing Indigo

I’m getting a great introduction to the security culture at Microsoft.

One of the Indigo components that I have PM responsibilities for is a long-running service (of the NT variety) that listens on the network. Because it’s basically the front door of Indigo, we’re spending a lot of time making sure our threat models and mitigations stay up-to-date as the product evolves in its lifecycle.

We have lots of threat models and mitigations in place to make sure that our component doesn’t get hacked. But even so, a lot of our threats start with “assume that the Listener gets hacked…”

Why do we do this Defense in depth. We want to make sure that even if our component gets compromised, there’s nothing that a hacker could do with that achievement.

Saying “we think we’ve found all the threats” isn’t nearly as good as saying “we think we’ve found all the threats — and even if we missed one, there’s nothing a hacker could gain by compromising our component.”