Microsoft this week announced an agreement to collaborate with Adobe systems and facilitate advanced information sharing on vulnerabilities via its Microsoft Active Protections Program (MAPP), which Adobe will join. MAPP is a collaborative effort involving 65 global members that facilitates the sharing of product vulnerabilities with security software providers. Adobe will join the program in the fall of this year.
Commenting on the agreement, Brad Arkin, senior director of product security and privacy at Adobe admitted that “Adobe has attracted increasing attention from attackers.”
Microsoft also discussed a new policy of coordinated vulnerability disclosure — a reframing of responsible disclosure — and introduced new tools and guidance that will improve online security for customers. In response to the ongoing debate between responsible disclosure (where a bug is disclosed only to the software vendor who then fixes it) and full disclosure (where the bug is publicly disclosed), Microsoft will move to a policy it calls coordinated vulnerability disclosure. The company defined the new policy as follows:
“Microsoft believes coordinated vulnerability disclosure is when newly discovered vulnerabilities in hardware, software and services are disclosed directly to the vendors of the affected product, to a CERT-CC or other coordinator who will report to the vendor privately, or to a private service that will likewise report to the vendor privately. The finder allows the vendor an opportunity to diagnose and offer fully tested updates, workarounds or other corrective measures before detailed vulnerability or exploit information is shared publicly. If attacks are underway in the wild, earlier public vulnerability details disclosure can occur with both the finder and vendor working together as closely as possible to provide consistent messaging and guidance to customers to protect themselves.”
Microsoft also announced the release of a new tool, the Enhanced Mitigation Experience Toolkit (EMET). EMET is a free tool that brings newer security mitigations to older Microsoft platforms and applications. It is specifically designed to block targeted attacks against unfixed vulnerabilities. The tool will be available in August.