Between the Lines

Larry Dignan, Andrew Nusca and Rachel King

Microsoft aims to close Patch Tuesday vulnerability window

By | August 5, 2008, 6:22am PDT

Microsoft is upping the ante in an effort to head off hackers at the Patch Tuesday pass.

Ryan Naraine reports
:

The new Microsoft Active Protections Program (MAPP), which will be formally announced at Black Hat USA 2008 here, will give anti-virus, intrusion prevention/detection and corporate network security vendors a head start to add signatures and filters to protect against Microsoft software vulnerabilities.

The idea is to provide detection guidance ahead of time to help security vendors reproduce the vulnerabilities being patched and ship signatures and detection capabilities without false positives.

If folks deployed Patch Tuesday fixes right away–like the minute they were released by Microsoft–that heads up to security vendors wouldn’t be necessary. But the reality is that IT shops have to test the patches first and that takes time. During that time exploit code can be launched.

Hats off to Microsoft for being proactive. The program has its risk–especially if Microsoft’s vulnerability data can be intercepted–but it’s worth a shot

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic.

Disclosure

Larry Dignan

Larry Dignan has nothing to disclose. He doesn’t hold investments in the technology companies he covers.

Biography

Larry Dignan

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic. He was most recently Executive Editor of News and Blogs at ZDNet. Prior to that he was executive news editor at eWeek and news editor at Baseline. He also served as the East Coast news editor and finance editor at CNET News.com. Larry has covered the technology and financial services industry since 1995, publishing articles in WallStreetWeek.com, Inter@ctive Week, The New York Times, and Financial Planning magazine. He's a graduate of the Columbia School of Journalism and the University of Delaware.

For daily updates, follow Larry on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
9
Comments

Join the conversation!

Just In

To be REALLY secure:
Joel R 2nd Sep 2008
And I agree bunnyman, the only secure computer isn't connected to anything else... (this could even mean the operator in some cases... heh heh)

Actually, it would include not connecting to the power grid or battery as well. Total electricity deprivation is the only sure way to protect against any and all threats.
0 Votes
+ -
This is good, potentially anyway.
bunnyman 6th Aug 2008
MFST did not get to be where it is by being "stupid". Granted, they have their "flaws", but so does everyone on this Planet. The reason that "hackers" virus writers, etc. target Windows is clear. The OS is the MOST widely used on Earth, hence mass damage. Same reason that Norton Anti-Virus has been "targeted" lately. I agree, hat's off to MSFT for this move. I hope it works as planned to.
Final Thought: The ONLY absolutely "Secure Computer" is disconnected from the Internet.
0 Votes
+ -
1 Thumb up for Microsponge
drdunc 6th Aug 2008
Yep, You gotta give credit where credit is due.
I'll give MS a 1 good thumb for this, but it will most probably just change the way the attacks are done and the cycle starts again.
And I agree bunnyman, the only secure computer isn't connected to anything else... (this could even mean the operator in some cases... heh heh)
I seem to remember way back when NT server (or one of them) came out it got a great security rating.... but only when no other PC's where connected to it. lol.
0 Votes
+ -
To be REALLY secure:
Joel R 2nd Sep 2008
And I agree bunnyman, the only secure computer isn't connected to anything else... (this could even mean the operator in some cases... heh heh)

Actually, it would include not connecting to the power grid or battery as well. Total electricity deprivation is the only sure way to protect against any and all threats.
When will we get the patch?
I've long said that MS Black Tuesday was a bad idea that only an empty IT suit could love.

Batching security patches up into a single monthly embolism has always left a wide open window of opportunity for the BadGuys with O-Days to get their licks in.

So now MS is going to share *critical vulnerability data* with "security vendors," so that allegedly patched vulnerabilities can be silently mitigated in advance of MS Black Tuesday. This is just another form of security through tortuous obscurity.

eEye Digital Security already has a product that actively mitigates some O-Day and all MS Black Tuesday security holes. It's called Blink and it's been working, as advertised, for more than two years.

Blink provides sysadmins with *protected* breathing time, to test and vet patches, before having to roll them out into production. This was the only sane way to go, from Day One. Release patches as soon as they have been QFE tested, but enable active mitigations in the meanwhile, so that each shop may proceed with testing and deployment according to its own time table, not MS'.

Blink is also effective for protecting legacy NT4 systems, for which MS hasn't written any patches in a great long while.

Does this announcement mean that MS is now going to help all of the "catch-up" vendors eat some of Blink's hard earned lunch?
0 Votes
+ -
IT got what htey asked for.
notsofast 7th Aug 2008
Some of us are old enough to remember when MS released patches on a regular basis (i.e. several times a month). It was IT that asked them to bundle them.

It certainly wasn't the lowly end user, since they either install them or they don't, but they certainly don't test them before they deploy them.
0 Votes
+ -
Funny, but...
jasonp@... 11th Aug 2008
I don't remember ever asking, nor did anyone I know. I've heard the claims that IT asked for this, but have yet to meet a single IT person who will admit to asking. Makes me wonder who this elusive "IT" really is.
0 Votes
+ -
Short memory...
MyBlueRex 28th Aug 2008
Jason, you've obviously got a very short memory... or you were not in the IT business before Microsoft started batching them on the 2nd tuesday.

As one of these supposedly elusive IT's that has been in this business for the past 20 years, I can EASILY remember the screaming for help from the IT industry.

It would be quite possible to spend one weekend testing a patch, rolling out a patch to say 20 servers, evaluating the patch stability, etc... and once that period was over, rolling it out to the rest of the servers.

This was a very painful and obviously consuming time process... and all that effort was basically null and void when Microsoft released another patch a few days later!!

That was the most painful situation to be in.

Patch tuesday IS a great method for normal level patches but these days with the dramatic increase of 0 day viruses etc... we need the critical patches to be released asap.
0 Votes
+ -
First of all . . .
psychosmurf Updated - 7th Aug 2008
. . . it's 0-day (that being ZERO-day; not O-day as in 'Oh my God this person has no clue what he's talking about').

Second of all it wouldn't matter if Microsoft offered to send someone to your home every time a vulnerability were found to install a fix, people would still gripe about it: Oh my Lord, Microsoft has seen my dirty underwear, KILL, KILL, KILL!

Let me guess; you don't like the UAC on Vista either, right? They can't do anything right when it comes to people like you and that makes your opinion valueless in the long-run.

I think this is a step forward; they're trying to make strides in security and nothing, nothing of any value ever happens over night. Kudos to MS for taking this step. Now how about fixing that pesky networking in Vista; you know the 'local only' access piece? wink

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix