Friday, December 19

Patch Tuesday Catylst for 0-Day Wednesday

As well intentioned as Microsoft is regarding getting security patches out to the public, they've created a vulnerability for people by setting a date for the release of security fixes each month and on a monthly basis. By releasing previously unknown (by Microsoft) vulnerabilities the day after the fixes are released they get maximum exposure (about 30 days or so) unless MS provides an out-of-band patch.

Is this recent behavior enough to get Microsoft to abolish their practices of once a month patch releases? I think it should be - as patches should be released as soon as possible for each fix. But I also understand it costs money to test and out releases.

Plus this still doesn't even touch the issue of the unannounced vulnerabilities, which in my opinion is a much greater risk than the ones we know about.
Post a Comment