Microsoft Secure Future Initiative Sfi Skill

SFI Core Principles

Three principles anchor Microsoft's approach to SFI:

Satya's Mandate (May 2024): "If you're faced with the tradeoff between security and another priority, your answer is clear: Do security."

SFI Foundations

Four foundations that underpin successful security operations:

SFI Six Pillars

Secure by Design

Threat Modeling (STRIDE)

Security Requirements Checklist

Before coding:

• Authentication method defined
• Authorization model designed
• Data classification done
• Encryption requirements clear
• Logging requirements defined
• Third-party dependencies reviewed

Secure by Default

Principle of Least Privilege

// Bad: Admin access by default
const user = { role: 'admin', permissions: ['*'] };

// Good: Minimum permissions
const user = { role: 'viewer', permissions: ['read:own'] };

Secure Defaults

// Bad: Optional security
createServer({ https: false, cors: '*' });

// Good: Secure by default
createServer({
    https: true,
    cors: ['https://trusted.com'],
    helmet: true
});

Input Validation

// Validate and sanitize ALL input
function processInput(input: unknown) {
    const validated = schema.parse(input); // Zod, Joi, etc.
    const sanitized = sanitize(validated);
    return sanitized;
}

OWASP Top 10 Quick Reference

Credential Management

Never Hardcode

// NEVER
const apiKey = 'sk-1234567890abcdef';

// ALWAYS
const apiKey = process.env.API_KEY;
// Or: Azure Key Vault, AWS Secrets Manager, etc.

Rotate Regularly

Credential Type     | Rotation Period
--------------------|----------------
API Keys            | 90 days
Service Passwords   | 90 days
Certificates        | 1 year
User Passwords      | User discretion + breach response

Secrets in Git

If secrets accidentally committed:

1. Revoke immediately — The secret is compromised
2. Remove from history — git filter-branch or BFG
3. Rotate — Generate new credentials
4. Audit — Check for unauthorized use

Dependency Security

Regular Audits

# npm
npm audit
npm audit fix

# Check for outdated
npm outdated

Automated Scanning

• Dependabot (GitHub)
• Snyk
• npm audit in CI/CD

Update Strategy

Security Code Review

Checklist

• No hardcoded secrets
• Input validation present
• Output encoding for XSS
• SQL uses parameterized queries
• Auth checks on all endpoints
• Sensitive data encrypted
• Errors don't leak info
• Dependencies up to date

Red Flags

🚩 eval(), exec(), dangerouslySetInnerHTML
🚩 String concatenation in queries
🚩 Disabled security features
🚩 Overly permissive CORS
🚩 Secrets in code or config files
🚩 Missing rate limiting
🚩 Verbose error messages

Incident Response (Security)

1. Contain — Limit blast radius
2. Preserve — Don't destroy evidence
3. Notify — Security team, legal if needed
4. Investigate — What happened, how
5. Remediate — Fix + prevent recurrence
6. Report — Breach notification if required

Synapses

See synapses.json for connections.