Windows users patch fast when zero-day hype heats up
People patch zero-day bugs faster, whether Microsoft goes out-of-band or not, says researcher
Computerworld - It's the publicity around zero-day bugs that drive Windows users to patch their software quickly, not the fact that Microsoft sounds the alarm by issuing an emergency update, a researcher said today.
Windows users rush to patch whenever a zero-day vulnerability is involved, even when Microsoft doesn't deliver the fix in an out-of-band update, said Wolfgang Kandek, chief technology officer at Qualys, a California-based security risk and compliance management provider.
Kandek analyzed data acquired from several hundred thousand PCs that Qualys monitors for its customers, and concluded that the existence of a zero-day bug -- a vulnerability for which exploit code has gone public before a fix is ready -- is the driver for faster patching. He found that the patching speed of two Microsoft updates that addressed zero-days in Internet Explorer were nearly identical, even though one had been released as part of the company's standard Patch Tuesday, and the other was issued as an out-of-band update.
According to Kandek, MS09-072, a December 2009 Patch Tuesday update that fixed five flaws in IE, including one zero-day, reached "half-life" in 10 days. Qualys defines "half-life" as the point where 50% of the machines have been patched. Meanwhile, MS10-002, a January 2010 patch that Microsoft rushed out the door ahead of schedule to fix an IE zero-day, made it to the half-life mark in nine days.
Both zero-day vulnerabilities were widely reported on the Internet, including on Computerworld.com, although the January out-of-band update was covered more widely, since it had been involved in attacks against Google, Adobe and other major technology companies.
"This tells me that media coverage is what helps," said Kandek. "While [the media] covers the usual Patch Tuesday updates, it doesn't come close to the attention a zero-day receives."
Kandek speculated that publicity may prompt network administrators to put shoulders to the wheel because of pressure from managers who had seen reports of the zero-day, and wanted fixes pronto.
The two zero-day fixes reached half-life about 36% faster than operating system-level updates overall, said Kandek. Last year, Qualys calculated the average half-life of those updates as 15 days.
And they were applied even faster than a benchmark update Kandek selected, MS10-001, the year's first Patch Tuesday release. MS10-001 patched just one vulnerability, which was rated "critical" only for Windows 2000. For all other editions of Windows, the bug was ranked as "low," the least dangerous of the company's four-step threat scoring system.
At 21, the half-life of MS10-001 was more than double that of either zero-day patch.
Although an out-of-band update may not be applied any faster than a "standard" Patch Tuesday zero-day fix, the fact that Microsoft accelerates the former means that users are protected sooner than if the company waited until the next round of monthly updates. If Microsoft had delayed MS10-002 until its intended release date of Feb. 9, it would have taken until Feb. 18 before approximately 50% of all PCs were patched. As it was, the 50% mark was reached on Jan. 30, nearly three weeks sooner.
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!