, SecurityFocus 2006-01-12
Story continued from Page 1
However, even in the best case, Microsoft may not be able to shave much more time off its response.
The software giant's delay in getting a patch to users was mainly due to quality control. The software giant had a patch candidate in less the 24 hours, but testing the patch against all its operating systems as well as popular applications took far longer. And, if the company had to make the choice all over again, it would still make the same decision, because breaking even a small number of systems' functionality is unacceptable, Kevin Kean, director of the Microsoft Security Response Center (MSRC).
"Lets talk about the consequences of someone not having confidence in your patch," Kean said. "If Microsoft blows it, if people cannot trust our patches, they will not deploy them. It is critical that people have confidence in our patches, and that has been built into our ethos."
The software giant put more than 200 people on fixing the flaw and testing the patch, Kean said. The company's product teams vetted hundreds of applications to make sure that the patch caused no conflicts. As a result of the all-out development effort, Microsoft released the patch nine days after first learning about the vulnerability.
That may be the fastest the software giant has turned around a fix on a widespread software flaw. In a survey of security advisories released by Microsoft in the past three years, the Washington Post found that Microsoft has taken longer to fix vulnerabilities privately reported to the company, but has shortened its time to respond to public disclosures, which includes zero-day attacks. Microsoft took 3 months on average to fix issues privately disclosed to the company in 2003, a response time that shot up to 4.5 months in 2004 and 2005, according to the analysis. Yet, the company response to a publicly disclosed flaws has quickened, from 71 days in 2003 to 46 days in 2005.
The survey also found that Microsoft has apparently been successful in convincing security researchers to disclose vulnerability information to the software giant first. In 2003, the company learned about eight critical vulnerabilities through public disclosure, but that happened only half as many times in 2005, according to the Washington Post analysis.
Yet, those numbers may miss a critical trend in who is finding vulnerabilities. Increasingly, zero-day vulnerabilities are not being disclosed at all by those who find them, generally attackers bent on using the flaw to compromise a small number of high-value targets, said Mike Puterbaugh, senior director of product marketing with network protection firm eEye Digital Security.
"Anyone with a zero-day is going to use it for a specific purpose," Puterbaugh said. "They are not going to go after my grandmother. They are going to use it to go after Citigroup, a government contractor or a university."
That means that companies will increasingly have to worry--not about the potential zero-day attacks that make the headlines--but the ones that are targeted at small groups, a situation that makes patching an ineffectual defense, Puterbaugh said.