Microsoft readies first attack forecast

Microsoft debuts predictions that rate "exploitability" of vulnerabilities.

Gregg Keizer (Computerworld)
14 October, 2008 08:01
Comments

Microsoft will debut vulnerability predictions today when it issues 11 security updates for Windows, Office and Internet Explorer.

Announced more than two months ago, the "Exploitability Index" will be added to the bulletins that accompany each update. Microsoft's security experts will rate each vulnerability using a three-step ranking, in descending order of severity:

Consistent exploit code likely

Inconsistent exploit code likely

Functioning exploit code unlikely

Microsoft expects that users and corporate IT administrators will combine the index rating with the company's current threat rankings, which estimate the potential impact as "critical" through "low," to prioritize patches.

Also tomorrow, Microsoft is expected to reveal more information about another new program it talked up in August, Microsoft Active Protections Program (MAPP). An information-sharing effort, MAPP gives select security vendors an early jump on crafting exploit signatures by providing technical details of to-be-patched vulnerabilities before updates are issued. Prior to the program, security vendors had to wait like any customer for Microsoft to issue its patches before they could begin examining the bugs and start developing anti-exploit protection.

Microsoft has not said which security vendors are participating in the program, how far in advance they are given the information, or even the amount or type of data Microsoft will share.

In response to questions last Friday, a Microsoft spokesman would only say, "There will be some new information [about MAPP], along with the Exploitability Index, come Tuesday with the bulletin release."

However, it appears that security companies that have been accepted into MAPP received previews of tomorrow's vulnerabilities as early as last Thursday. Then, a spokeswoman for nCircle Network Security Inc. said that because the company had joined MAPP, its researchers would not be available for comment on the pre-patch notification Microsoft released that day.

Microsoft will release its 11 security updates today.