Microsoft to give partners heads-up on security vulnerabilities

Microsoft will be giving companies that sell security software and services to its customers a sneak peek at the technical details of the vulnerabilities in Microsoft software before the company releases its monthly "Patch Tuesday" updates.

The new Microsoft Active Protections Program, set to be announced at the Black Hat security conference on Tuesday, is designed to give software vendors a chance to prepare updates to their software before attackers have a chance to reverse engineer Microsoft's security patch and create an exploit.

"It's essentially a race between the attackers and the protectors," said Andrew Cushman, who runs the Microsoft Security Response Center. The program will "give a head start to software providers delivering security features to our mutual customers."

"It will save (vendors) the work of reverse engineering the patch and identifying where the vulnerability is and what triggers the exploitability," he said.

Cushman did not say how vendors would be notified or how much lead time they would get. Software companies that provide protection against host-based or network-based attacks will have to apply for membership to the program and be accepted. They and Microsoft will then be under mutual non-disclosure agreements, he said.

"The goal is to give it to them so they can have updates available as close to 10 a.m. as possible" on the second Tuesday of every month, Cushman said.

The program will begin in October. Microsoft has already floated the idea by IBM/ISS, TippingPoint and Juniper, he said.

Microsoft also will be providing an Exploitability Index in its monthly security bulletins beginning in October that will help organizations prioritize vulnerabilities by assigning one of three ratings to each one based on the likelihood of exploits being developed. The ratings from most severe to least severe are: "exploitation is likely to occur and to be reliable," "exploitation is likely to occur but with inconsistent reliability" and "exploitation is unlikely to occur," according to Cushman.

Click here for full coverage of Black Hat 2008.

[n3td3v]

Verbal contracts of non-disclosure agreements don't work, you need a new law in place, which I call the responsible disclosure act, http://seclists.org/fulldisclosure/2008/Jul/0439.html to enforce the agreement by a law if the agreement is broken. Or are you guys just gonna do another "oops the cat's out the bag" again like what happened with the verbal contract agreement Dan Kaminsky had with everyone before a blog entry leaked the vulnerability by *accident*. Is this Microsoft agreement of non-disclosure actually enforceable by any current law? If not a new law is needed to be drawn up, see the link above, or this "Microsoft Active Protection Program" is gonna turn out a complete shambles.

[jcorio]

Yeah... but this isn't like the whole Matasano/Kaminsky thing... these are actual businesses that have partnered together previously and have well vetted non-disclosure agreements and contracts in place. These are (and have been many times) enforcable by law.

[The_Decider]

If it was to be announced at Black Hat, then why did they announce it earlier?

This is a positive development, however, wouldn't it be better if MS spent their time creating an OS that isn't exploited every minute of every day?