Microsoft security specialist urges 'assume breach' approach in secure-coding briefing to ETS

Rich Antonow, a Microsoft security and identity technical specialist, told Enterprise Technology Services staff that developers must write code with the expectation that networks and systems may already be compromised. "Assume breach," Antonow said, identifying that mindset as the core zero-trust principle developers should use when deciding authentication, authorization and data-storage practices.

Antonow framed secure coding as an environmental problem, not only a matter of individual functions. He listed three foundational developer responsibilities from zero-trust doctrine: "assume breach," "verify explicitly" and implement "least-privileged access." He argued that code should avoid elevated test accounts and that applications must rely on proper identity providers for authentication while performing their own validation…