Microsoft's urgent security update: What it means
Jon Oltsik recommends that network administrators treat Microsoft's newest patch with urgency, but says the out-of-cycle release bodes well for the company's security efforts.
Earlier today, Microsoft did something unusual. The company made an exception to its normal security processes and issued an "out-of-band" urgent update. The update applied is classified as critical for Windows XP and older versions and is considered important for Windows Vista.
After speaking with Microsoft earlier today, I strongly suggest that users understand the importance of this update and begin emergency patching procedures immediately. While exploits around this Windows vulnerability have been limited thus far, Microsoft concedes that it could be exploited by old-school Internet-based worms a la 2004 and do massive amounts of damage. In addition to patching Windows systems, I also encourage users to install the latest security signatures from endpoint and network security vendors.
Microsoft's "out-of-band" reaction speaks to the seriousness of this threat, but I can't help but be impressed with the behind-the-scenes effort that led to this action. It is noteworthy to point out a few things:
1. Microsoft security researchers discovered this vulnerability themselves with the aid of some customer data. In other words, this vulnerability was not brought to Redmond's attention by a third-party researcher, Black Hat Web site "chatter," or a series of massive malicious exploits. This is a good proof point to those who still believe that Microsoft does not take security seriously.
2. In preparation for the urgent update, Microsoft has been sharing data and patches with other endpoint and network security vendors as part of a number of security partnering programs. This means that notification from Microsoft will likely be followed by new security signatures and support by leading security vendors.
3. It is worth mentioning that the vulnerability in Windows Vista is not as pronounced as older versions of Windows. To me, this speaks to the effectiveness of the Security Development Lifecycle (SDL) process. Lessons learned from this vulnerability will be integrated into future revisions of SDL as part of a constant improvement cycle.
Some will point fingers at Microsoft and claim that this "out-of-band" security bulletin is further proof that Microsoft remains an anathema to security. I don't share this view. Complex software will always contain vulnerabilities and bugs. The trick is to fix as many as you can during the development and testing process, continue security research once software is released, and respond to problems with professionalism, industry collaboration, and haste. In my view, Microsoft is doing a good job at following this model.