> Are you now telling me that this is beyond the capability of software engineering? If so, then we need to drop the word 'engineering' from 'software' and start completely a fresh.

No. I am telling you that china sending a military specialops unit to break into fort knox is not a sign that fort knox was negligent.

> Talk about a defeatist attitude. This negative attitude is the real problem.

There is a difference between understanding real world dynamics and planning for them and being defeatist. Acknowledging disparities in resources and capabilities is not defeatist, it is risk assesment which you can plan around. In the infosec world it is one of the first rules for APTs that prevention is a failing strategy. There are entire courses and certifications you cam take and countless compromise case studies you can lean from. You cannot prevent an APT compromise but you can detect it and reduce dwell time. You can setup deception tech, collect a ton of logs and hunt for them (MS makes this difficult btw -- blame them on that if anything) and creat the most hostile environment for them to give you enough time to detect them before they do damage but you cannot prevent a compromise as a strategy. This is because they have more resources than even a company like MS and they are persistent (not neccesarily sophisticated). This is apt 101, they may get bored and move on to the next vicitim but that aside if China wants to hack MS, it will happen (as well the US and tencent)". The problem is you disagree with decades of infosec school of thought because as SWE (if I may presume -- or other non-infosec tech person) you are used to solving problems of a technical nature and evem though I clearly tried to explain that this isn't a technology problem, you don't get it, and a lot of people (even newbies in infosec) don't get this. Lookip the "$5 wrench" xkcd for a humorous take in this.

> OK, what's your solution to bring down cyber attacks from the billions per year to about the same tolerable level we have for banks and security for other physical objects?

I don't need to solve it, how to slow down and catch apts is a solved problem. Look up twitter infosec threads on this compromise, many, self includes, are hoping MS will finally get their heads out their greedy arses and expose logs and apis that are usually very expensive to all their customers because of this for example. More logs, more/better detections from the infosec end of things is what everyone in infosec agrees on afaik. But in reality, our country needs to retaliate in kind and publicly against China as a detterrent (even if it means escalsting conflict), that is what is normally done when a foreign state attacks your private companies, the US military/IC are supposed to be our ultimate deterrent but people like you expect MS to do that when hacking back in retaliation by private companies is illegal (as it should be).

> Fact: cyber security is not fit for purpose.

Understand what "cybet security" means in this context first before you make generalist statements like that.

> You solution please....

See above and other comments on thread from me

> PS: 'engineering', by definition, is about finding solutions to problems.

You should first understand the root cause of the problem (malicious humans, resource disparity and missing visibility) before trying to solve it. For example, the threat actors accessed outlook on government accounts right? Did the government have logs that could detect that? Did MS ? Was there enough detail in the logs? There are so many unanswered questions about the attack.

We've been fighting apts for roughly 20yrs now, how to catch them and make life harder for them a discipline that is taught in detail. There is no silver bullet or magical perfectly impenetrable yet at the same time highly useful and complex system. Hats off to you though if you can replace azure ad with such a system and prove many wrong.