Microsoft to shift to “coordinated vulnerability disclosure” for improved security

Microsoft to shift to “coordinated vulnerability disclosure” for improved securityAnnouncing a new approach to address security issues, Microsoft said at the Black Hat security conference in Las Vegas that it intends focusing on collaboration between software vendors and security researchers for speedier identification of security threats and vulnerabilities.

Noting that it is difficult to achieve secure computing in the vast landscape if software vendors and researchers work independently, Microsoft said that the new approach – which it said was a Neighborhood Watch-like scheme – essentially aims at shifting the culture of vulnerability and security research from “responsible disclosure” to a more effective “coordinated vulnerability disclosure.”

Having already announced a new security disclosure policy – “Coordinated Vulnerability Disclosure” – last week, Microsoft elaborated that under the new policy, security researchers and software vendors will work in tandem to ensure that patches have been put in place before the announcement of any newly discovered vulnerability.

In case it becomes apparent that the flaw has exploits in the wild, the researchers and vendors will reveal the flaw earlier, and in full.

To extend the new scheme, Microsoft will notify the same network of partners of looming updates to Adobe’s software. Some days before the release of its updates, the details will be circulated to nearly 65 security companies – having almost one billion customers in all - so that they can timely update their products and provide adequate protection against the escalating number of exploits targeting Adobe’s software.