The loss of a master key, which allows unauthorized people to issue themselves working access tokens, is in itself a debacle for any reputable software provider. But in the case of Microsoft, after the initial shock, more questions arise: Why does the company continue to remain silent about the extent and possible consequences? Why does Microsoft even rely on a technology based on a master key? And why do third parties manage to steal it?
To begin with, the existence of master keys is not a questionable business practice, nor is it a failure on the part of the vendor. Rather, it is a necessity of the business model, where Microsoft both hosts the cloud services and monitors the respective access to them. And even if the providers cannot be accused of malicious intent, it is ultimately the users who suffer the consequences of the theft.
The example shows why the centralized alignment of hyperscalers poses a significant security risk and the impact of dependence on large companies like Microsoft – because all customers depend on the communication and transparency of the providers to whom they have entrusted their data. But what if companies simply remain silent about such and similar incidents? And how many other, comparable risks and problems are concealed in this way?
Ultimately, the public usually only finds out about them when a security-critical incident becomes public. This is a fatal mistake when it comes to handling the data of all of us. The answer must therefore be: More communication, more transparency, more decentralization and more open source culture. Then our digital sovereignty will also work.
Interested in learning more about how ownCloud can ensure a high level of data security and 100% data control for your enterprise? Get in touch with us.
