Google wants software vendors to respond to vulnerabilities within 7 days
Vendors should issue fixes or at least mitigation advice for zero-day flaws within a seven-day time frame, Google security engineers say
IDG News Service - Google wants vendors to fix or offer mitigation advice for previously unknown and actively exploited software vulnerabilities within seven days of their discovery.
"After 7 days have elapsed without a patch or advisory, we will support researchers making details available so that users can take steps to protect themselves," Google security engineers Chris Evans and Drew Hintz said Wednesday in a blog post.
In 2010, Google researchers proposed a public disclosure deadline of 60 days for critical vulnerabilities and said that vendors should release a patch or mitigation information for them within that time frame.
"Based on our experience, however, we believe that more urgent action -- within 7 days -- is appropriate for critical vulnerabilities under active exploitation," the Google security engineers said. "The reason for this special designation is that each day an actively exploited vulnerability remains undisclosed to the public and unpatched, more computers will be compromised."
Over the years, Google security researchers have found dozens of cases where attackers were actively targeting publicly unknown, or "zero-day," vulnerabilities in software from third-party vendors, Evans and Hintz said. "We always report these cases to the affected vendor immediately, and we work closely with them to drive the issue to resolution," they said.
Many zero-day vulnerabilities are used against specific groups of individuals in targeted attacks that are often more serious than broader ones, the Google security engineers said. For example, political activists from certain parts of the world are frequently targeted and the compromise of their computers can have real implications for their personal safety, they said.
"Seven days is an aggressive timeline and may be too short for some vendors to update their products, but it should be enough time to publish advice about possible mitigations, such as temporarily disabling a service, restricting access, or contacting the vendor for more information," Evans and Hintz said.
Google expects to be held to the same standard and hopes that this new recommended time frame for zero-day vulnerability response will improve the coordination of vulnerability management and the overall state of security on the Web.
Carsten Eiram, the chief research officer at security firm Risk Based Security, agrees that making information about zero-day vulnerabilities known to users is important. "Each day an 0-day [vulnerability] is left undisclosed, systems are at a greater risk," he said Thursday via email. "Google providing other vendors with 7 days to respond by either publishing an announcement or a fix is very reasonable; they should not provide more."
Google has a fairly large security research team whose members are often credited by third-party vendors, including large ones like Adobe and Microsoft, with discovering vulnerabilities in their products.
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts