Microsoft and NIST are working on an industry-wide standard for security patches