Microsoft says it wants to "reframe" the guidelines for vulnerability disclosure, shifting the focus from responsible behavior to cooperation with software vendors; the new framework would offer less opportunity for disclosing vulnerabilities without the software vendor’s approval.
LAS VEGAS—Microsoft last week announced a “shift in philosophy” toward disclosure of vulnerabilities in IT software, hardware and services. The software giant wants to replace the current “Responsible Disclosure” model to what it is calling “Coordinated Vulnerability Disclosure" – a move which would give software vendors such as Microsoft greater control over the release of information about weaknesses.
The shift is partly semantic, said Dave Forstrom, Microsoft’s director of Trustworthy Computing. Wrangling over the subjective, emotionally loaded term “responsible” should be put aside in favor of cooperation between those who discover vulnerabilities and those who fix them, he said. But under the model proposed by Microsoft last week in its Security Response Center Blog, vulnerabilities would be made public only with “both the finder and the vendor working together as closely as possible,” even if an exploit for the vulnerability is in the wild.
This would in effect give a vendor final say over how, when and whether the public is notified of a new vulnerability.
Microsoft is discussing its new approach to vulnerabilities at this week’s Black Hat Briefings. It also is announcing that Adobe is joining its Active Protection Program, which gives vendors an advance look at its monthly security update release, and is releasing a toolkit to help mitigate new threats in older software.
The issue of disclosure of vulnerabilities discovered in software is a contentious one. Vendors often are critical of security researchers who make the information public before the vendor has had a chance to fix the problem, and researchers criticize companies that are reluctant to respond to their warnings with timely fixes.
"Some of these debates may never be resolved,” Forstrom said. But the model that has evolved and is generally used among responsible researchers is to notify a vendor or a third party such as US-CERT of a new vulnerability and give the vendor a chance to respond before going public with the information. The emphasis on who is responsible and who is irresponsible diverts attention from the need for cooperation, he said.
Premature exposure of vulnerabilities has in the past put the public at greater risk, he said.
However, in its Security Response Blog entry, Microsoft makes clear that the adoption of Coordinated Vulnerability Disclosure would greatly limit the information released to the public and give the vendor greater control over just what is said. "[O]nly in the event of active attacks is public disclosure, focused on mitigations and workarounds, likely the best course of action – and even then it should be coordinated as closely as possible,” Microsoft officials wrote.
There is no way to enforce the model, but Forstrom claimed Microsoft has received only positive feedback so far and that it believes it is responding to a groundswell of desire for better rules and processes for vulnerability disclosure.
For the past two years, Microsoft has been giving some vendors an advance look at the vulnerabilities and fixes included in its monthly updates through its Active Protections Program. About 65 member vendors get several days advance notice, which the company says helps to close the window of opportunity for attackers between the time the problems are announced and the fixes can be put into place by security companies.
The addition of Adobe to the companies in this group is significant because of the ubiquity of the company’s Acrobat and Adobe Reader software, and because of the shifting emphasis by hackers from operating systems to third-party applications, Forstrom said.
Also being announced this week is Microsoft’s Enhanced Mitigation Experience tool kit. This will be available as a free download from the company’s Download Center and will help administrators update older programs such as Internet Explorer 6 and Windows XP to protect against new threats without having to recompile the applications.
NEXT STORY: The 7 people who can restart the Internet