Microsoft Security Chief Issues Call to Arms to Protect Metaverse

(Bloomberg) -- Microsoft Corp.’s new security chief Charlie Bell issued a call to arms to build protection from hackers and criminals in the emerging metaverse from the start of the new technology.

“There’s going to be a lot of innovation and there will be a lot of struggling to figure out what has to be done,” Bell said in an interview. “But I think because of the speed, there will be fast innovation on the security side.”

The metaverse — a concept that promises to let users live, work and play within interconnected virtual worlds — will present some unique and more serious security challenges for technology and cybersecurity companies. As an example, hackers may be able to make avatars that look like a user’s trusted contacts, a twist on the traditional email phishing scheme that will be hard for users to resist, he said. The nature of the metaverse, which offers the possibility of less centralized control of content and users, also is a challenge for those trying to protect customers.

“Picture what phishing could look like in the metaverse — it won’t be a fake e-mail from your bank,” wrote Bell, Microsoft’s executive vice president, security, compliance, identity, and management, in a blog posted Monday on Microsoft’s web site. “It could be an avatar of a teller in a virtual bank lobby asking for your information. It could be an impersonation of your CEO inviting you to a meeting in a malicious virtual conference room.”

It’s critical for companies operating in the metaverse, which include Microsoft and Meta Platforms Inc., formerly known as Facebook, to design their new products with security and safety built in from the start, rather than bolted on later, after issues crop up. With applications likely to run the gamut from games to entertainment to corporate meetings, developers who are building the software and people using it will have to figure out how to police the metaverse, keeping out hackers, abuse, harassment and inappropriate content. The software companies will need to work together on interoperability of identities -- so a user can show they are who they say they are across multiple metaverses -- and on other security tools and steps, Bell wrote. Failing to plan ahead may doom the new technology. 

“We have one chance at the start of this era to establish specific, core security principles that foster trust and peace of mind for metaverse experiences. If we miss this opportunity, we’ll needlessly deter the adoption of technologies with great potential for improving accessibility, collaboration, and business,” said Bell, who, until he joined Microsoft in 2021, worked many years for Andy Jassy at Amazon.com Inc.’s cloud unit. 

With many metaverse platforms and many apps built on top of them, companies will need to work together to secure the potential gaps and seams between different systems. Tools will need to be designed such as multifactor authentication and customized ways to login without passwords. Bell also suggested something similar to recent advances in cloud security in which companies offer a single program to manage and watch security and access to multiple cloud programs from different vendors. 

Still the decentralized nature of the metaverse can also be an advantage if it means multiple companies bring their security expertise to bear in things like verifying identities and providing transparent bug reports, he said.