Category Archives: Thoughts

Microsoft, you have a problem

Recently (some will say – for many years by now) Microsoft is being criticized for its Information Security capabilities, as that it is slow to do the move from on-premises products security to also, in addition, a cloud provider security, which is, in my opinion, even harder.

This is my recent incident about it:

I recently accepted an email from one of Microsoft’s sub domains.

I use a commercial cloud email security service to protect my email traffic, and this system stopped this email from entering because the sub domain did not have any SPF record, so my email security service stopped this email as a possible email impersonating to be from Microsoft).

This sub domain still doesn’t have an SPF record, as I write this.

It is not a big security issue, but I know that if I was in charge of this online asset and I had such an issue – I will be glad if someone would alert me about it, so I tried to find a way to report this to Microsoft, but I did not find any explicit content directing where to report online security issues, so I opened a case at MSRC (Microsoft Security Response Center)

I am aware it is not a vulnerability but a missing security measure that MS better fix and I had no better place to report this to MS.

This is the response I got as my report was set by the MSRC analyst to a status of “This closed as a non-MSRC case.” (the bold text was highlighted by me):


Thank you for contacting the Microsoft Security Response Center (MSRC). We appreciate the time taken to submit this assessment.

Upon investigation we have determined that this does not meet the definition of a security vulnerability.

The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.

As such, this thread is being closed and no longer monitored. We apologize for any inconvenience this may have caused.

If you believe this to be a misunderstanding of the report, submit a new report at

Please include:

Relevant information previously provided in your initial report
Detailed steps required to consistently reproduce the issue
Short explanation on how an attacker could use the information to exploit another user remotely
Proof-of-concept (POC), such as a video recording, crash reports, screenshots, or relevant code samples

For more information on what qualifies as a security vulnerability please see the following:
Definition of a Security Vulnerability:

We thank you again for taking the time to submit this report!


<name of the analyst>

This is sad for at least two reasons:

  1. The core claim of the analyst is simply not true, technically – ” The website you reported does not contain a MX record, which indicates we do not use the domain to send email messages.  In which case SPF/DMARC records are not considered required and would not meet the bar for security servicing.”.
    MX record is for accepting emails. It can be absent and still it is possible to send emails from the relevant sub domain. Email sending and receiving works independently of each other.
    Hence, the core claim to block my report was based on mistaken or unknowledgeable information.
  2. I know it is not a vulnerability, but I guess MS should be happy to get any information that let it know it is missing a basic security measure, even if it is regarding an online attribute of it, not of a software product vulnerability

If Microsoft put at its MSRC frontline an analyst with such level of understanding how email works – then Microsoft really, really, have a problem.

And no, I will not open a new case at MSRC to prove them wrong. I will just go on with my life and Microsoft will need to live with the consequences of how it operates.

I will not make the extra mile effort when MS doesn’t even do the basics.

Allegory for Information Security

Allegory is a powerful tool to explain a complex topic or summarize it, so many times I  explain that Information Security should be like the atmosphere – it should be transparent (not felt, not bothering), it should prevent bad things (asteroids = malware/other attacks) from coming in, and prevent good things (like oxygen = sensitive/confidential data) from getting out.

About the ability of cyber insurers to avoid paying due to a cyberwar act claim

Following the news article from below – it is no news that insurers try to avoid paying, but their stand of not paying due to cyber war acts will not stand, in my opinion.

For a cyber act and/or malware, to be officially declared, in our digital anonymized worlds, as originated from a specific country and intended to be an act of war – I guess only other governments or unions of governments (e.g. UN, NATO) can declare that, and such declaration may have severe consequences, like… ahhmmm… starting a war… – so the insurers’ ability to avoid paying for this reason, is, I think, close to zero (although it may be a true fact in reality and they may be right in their claim, but they won’t be able to prove it)

Merck Settles NotPetya Insurance Claim, Leaving Cyberwar Definition Unresolved