Schneier on Security

ProPublica revealed that federal cybersecurity evaluators in late 2024 found Microsoft's Government Community Cloud High (GCC High) had severe security documentation deficiencies, with one reviewer calling it 'a pile of shit.' Despite being unable to verify the system's overall security posture, FedRAMP authorized the product anyway with a 'buyer beware' notice, allowing Microsoft to expand its government cloud business worth billions. Bruce Schneier highlights this as a troubling example of security theater in federal procurement.