Microsoft slates colossal Windows patch next week
Ties record with 13 security updates, plans to fix 26 bugs in Windows, Office
Computerworld - Microsoft today said it will deliver a record-tying 13 security updates on Tuesday to patch more than two dozen vulnerabilities in Windows and Office.
The company will ship a total of 13 updates next week, five of them pegged "critical," the highest threat ranking in its four-step scoring system. The 13 updates will tie the record from October 2009, when Microsoft issued the same number of bulletins, but fixed a total of 34 vulnerabilities. According to Jerry Bryant, a senior manager with the Microsoft Security Response Center (MSRC), next week's updates will patch 26 flaws.
"A lot? That's an understatement," said Andrew Storms, director of security operations at nCircle Network Security. "But we could have had 14," he added, referring to the emergency Internet Explorer (IE) update Microsoft released two weeks ago. That "out-of-band" update was originally slated to be included in the collection set to ship this month.
Of the eight updates not marked critical, seven were ranked "important," the next-lower rating, while one was pegged "moderate." Eleven of the 13 will affect one or more editions of Windows; the remaining pair will affect Office XP and Office 2003 on Windows, and Office 2004 for Mac.
"What's kind of interesting this month is that there are fewer applications updates," said Storms, talking about the 11-to-2 ratio of Windows-to-Office security bulletins. The trend, Storms noted, has been the opposite: Microsoft applications, primarily Office and IE, have been extensively exploited by hackers, who have shied away from Windows itself because attacking applications has been easier.
That's not to say there isn't evidence of long-standing trends in the massive matrix that Microsoft spelled out in today's advance notification. One trend: Newer software is generally more secure than older software.
"We know that the newer operating systems are more secure," said Storms. "They use newer code, and were created with SDL [Security Development Lifecycle]," he added. SDL is Microsoft's term for a programming philosophy that bakes security awareness into all aspects of development. As proof, Storms pointed to Windows Server 2008 R2, the newest version of Microsoft's server software. "It has the least number of bulletins," he said.
Server 2008 R2 will be affected by 5 of the 11 Windows updates. Windows 7, the newest client operating system, will be impacted by the same percentage, 45%, of the total. The eight-year-old Windows XP, meanwhile, will require 8 of the 11, or 73% of Windows updates, while the even older Windows 2000 will be affected by 9 of the 11, or 82% of the total.
"Every month, there's a new reason to get off the older operating systems, to get off the older applications," said Storms.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts