Microsoft becomes responsible software vulnerability discloser

SOFTWARE GIANT Microsoft has tipped its hat in the direction of vulnerability disclosures and promised to let people know when third-party applications are failing.

Some might say that Microsoft should focus on cleaning up its own backyard before commenting on the state of anyone else's, but not Matt Thomlinson, general manager for trustworthy computing security at Microsoft, who apparently thinks that now is the time for the company to stand up and act as an authority about software that is well-designed and secure. (*cough*)

Thomlinson took to the Microsoft security response blog pages to explain some changes at the firm, and explained that Microsoft's "Coordinated Vulnerability Disclosure" (CVD) process is being extended to third party products.

"We're providing more transparency and insight into our disclosure philosophy by announcing three updates to our disclosure practices - a CVD at Microsoft document, MSVR Advisories, and our internal corporate Disclosure of Vulnerabilities policy," he explained.

"The Coordinated Vulnerability Disclosure (CVD) at Microsoft document clarifies how Microsoft responds not only as a vendor impacted by vulnerabilities in its products and services, but as a finder of vulnerabilities in third-party products and services, and as a coordinator of vulnerabilities that affect multiple vendors."

Microsoft has already found fault with Google's Chrome web browser, and has posted two advisories. It added that the problems had been reported to the companies already, and that they had already been fixed. Which they were, over a month ago.

In-house, Microsoft has adopted an internal disclosure of vulnerabilities policy, which should help it stamp out any problems with third party software, and perhaps, its own. This will see its staff report on problems as and when they come across them.

"After a product or service is released, we feel security is a shared responsibility across the broad community. Collaboration between security researchers and vendors is ultimately about preventing attacks and protecting the computing ecosystem," explained Thomlinson.

"By working together through coordinated efforts when vulnerabilities are identified, we can effectively minimise customer risk while a solution is developed. We encourage others to adopt this philosophy in the interest of creating a safer and more trusted Internet for everyone." µ