Windows users patch fast when zero-day hype heats up
People patch zero-day bugs faster, whether Microsoft goes out-of-band or not, says researcher
Computerworld - It's the publicity around zero-day bugs that drive Windows users to patch their software quickly, not the fact that Microsoft sounds the alarm by issuing an emergency update, a researcher said today.
Windows users rush to patch whenever a zero-day vulnerability is involved, even when Microsoft doesn't deliver the fix in an out-of-band update, said Wolfgang Kandek, chief technology officer at Qualys, a California-based security risk and compliance management provider.
Kandek analyzed data acquired from several hundred thousand PCs that Qualys monitors for its customers, and concluded that the existence of a zero-day bug -- a vulnerability for which exploit code has gone public before a fix is ready -- is the driver for faster patching. He found that the patching speed of two Microsoft updates that addressed zero-days in Internet Explorer were nearly identical, even though one had been released as part of the company's standard Patch Tuesday, and the other was issued as an out-of-band update.
According to Kandek, MS09-072, a December 2009 Patch Tuesday update that fixed five flaws in IE, including one zero-day, reached "half-life" in 10 days. Qualys defines "half-life" as the point where 50% of the machines have been patched. Meanwhile, MS10-002, a January 2010 patch that Microsoft rushed out the door ahead of schedule to fix an IE zero-day, made it to the half-life mark in nine days.
Both zero-day vulnerabilities were widely reported on the Internet, including on Computerworld.com, although the January out-of-band update was covered more widely, since it had been involved in attacks against Google, Adobe and other major technology companies.
"This tells me that media coverage is what helps," said Kandek. "While [the media] covers the usual Patch Tuesday updates, it doesn't come close to the attention a zero-day receives."
Kandek speculated that publicity may prompt network administrators to put shoulders to the wheel because of pressure from managers who had seen reports of the zero-day, and wanted fixes pronto.
The two zero-day fixes reached half-life about 36% faster than operating system-level updates overall, said Kandek. Last year, Qualys calculated the average half-life of those updates as 15 days.
And they were applied even faster than a benchmark update Kandek selected, MS10-001, the year's first Patch Tuesday release. MS10-001 patched just one vulnerability, which was rated "critical" only for Windows 2000. For all other editions of Windows, the bug was ranked as "low," the least dangerous of the company's four-step threat scoring system.
At 21, the half-life of MS10-001 was more than double that of either zero-day patch.
Although an out-of-band update may not be applied any faster than a "standard" Patch Tuesday zero-day fix, the fact that Microsoft accelerates the former means that users are protected sooner than if the company waited until the next round of monthly updates. If Microsoft had delayed MS10-002 until its intended release date of Feb. 9, it would have taken until Feb. 18 before approximately 50% of all PCs were patched. As it was, the 50% mark was reached on Jan. 30, nearly three weeks sooner.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Cybersecurity Imperatives Reinvent Your Network Security With Palo Alto Networks The Rise of CyberSecurity
- 10 Things Your Next Firewall Must do Next-Generation Firewalls Defined
- Firewall Buyers Guide Operate as the core of your network security infrastructure
- Getting Started With a Zero Trust Approach to Network Security The Traditional Approach to Network Security is Failing. View Now>>
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts