Microsoft to warn security vendors

AT BLACK HAT 2008, Microsoft plans to announce that in October it will start warning security vendors about its software vulnerabilities in advance of its monthly patch releases.

Microsoft's Active Protections Program (MAPP) will provide vendors of antivirus, firewall, intrusion detection and corporate network security software some preparation time to code signatures and filters to address newly-discovered security flaws in Microsoft's products.

The Vole's new vulnerability warning practice is intended to cure the problem user security administrators presently face where malware hackers sometimes devise exploits for certain security vulnerabilities before security vendors can develop protections and users can test and install Microsoft's Patch Tuesday fixes, indicated Mike Reavey, group manager of the Microsoft Security Response Center.

Reavey said, "The amount of time between the release of a patch and the release of the exploit code continues to shorten and customers have been asking for information to react to this."

Of course, users might alternatively choose to avoid most Patch Tuesday related hassles, and possibly cut down their spending on Windows antivirus software, by switching over to non-Microsoft operating systems instead. µ

L'Inq
Zdnet