Feeds

MS roll out exploit prediction with Patch Tuesday

Here is the attack forecast

Internet Security Threat Report 2014

Microsoft plans to debut impact predictions related to vulnerabilities with the next edition of its Patch Tuesday update cycle.

The 11 bulletins due to arrive later on Tuesday (14 October) will contain "weather predictions" detailing factors such as whether exploit code is likely to appear, alongside the established rating system on the severity of vulnerabilities. Microsoft hopes its Exploitability Index will help organisations to prioritise patching.

Microsoft, unlike Cisco and organisations like US Cert, won't be rating vulnerabilities under Common Vulnerability Scoring System. This is because it reckons (with some justification) that descriptions such as 'critical' or 'moderate' are more meaningful to the majority of people than ratings of between one and ten covered by CVSS.

Information on whether or not an exploit is available and assessments on the severity of threats are already available through the SANS Institute's well regarded monthly summary of Microsoft's bulletin. The Exploitability Index, announced two months ago, adds a predictive (crystal ball gazing) element to the mix.

Microsoft is also due to begin rolling out a program to give security vendors advance details on upcoming patches. The Microsoft Active Protections Program (MAPP), also announced at the Black Hat conference back in August, will operate under non-disclosure agreements to give anti-virus suppliers and the like the chance to prepare for patches and the attacks against unpatched Windows PCs that sometimes follow. Previously, the likes of Symantec and Sophos had no more idea what was due to arrive on Patch Tuesday than the great unwashed.

Tuesday's updates are due to cover flaws involving various components of Windows and Office, as well as an update from Microsoft Host Integration Server software. Four of these updates earn the dreaded rating of critical. ®

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.