The Alarming Rate of Microsoft Advisories: What It Means for Users and Businesses

As the 20th anniversary of Patch Tuesday approaches, cybersecurity commentators are reflecting on the long-standing program that brought predictability to Microsoft security patch cycles. There is no doubt that Patch Tuesday has significantly improved the security of Microsoft‘s customers, as reflected in the number of companies that have established their own patching schedule. However, the quality of the vulnerability descriptions in Microsoft‘s security advisories has been noticeably declining, rendering them nearly meaningless. This decline in quality has been occurring for a few years, with the Microsoft-created CVE descriptions being the most affected. Practitioners trying to prioritize vulnerabilities are finding it challenging to do so when information provided is inadequate or unclear.

The significant impact on practitioners, due to poor vulnerability descriptions, is that it is difficult to know what the issues are, making it impossible to prioritize vulnerabilities. For instance, it is unclear for many practitioners whether Microsoft‘s Message Queuing Remote Code Execution Vulnerability is hazardous or not, let alone what it is or what major software uses it. Consequently, they must hunt for information online on their own, which MITRE aimed to solve by creating well-defined rules for CVE descriptions. Unfortunately, Microsoft sometimes ignores these essential rules or opts to skirt around them, which harms everyone else. Microsoft‘s security advisories do not keep up-to-date with cybersecurity concerns, thereby putting practitioners at a disadvantage.

As a solution to the information gap, third-party organizations like Zero Day Initiative have stepped in to plug the gap by publishing a rundown of Patch Tuesday advisories. However, this information should have been in the CVE catalog because it is crucial for defenders’ context, vulnerability prioritization, and historical safekeeping.

In conclusion, Microsoft‘s Patch Tuesday program has been around for 20 years, bringing predictability to Microsoft security patch cycles, but there is still more Microsoft can do. The company owes the community more information related to vulnerabilities. CVE descriptions should not be brief eight-replace sentences, but instead, they should provide enough information to give practitioners a good understanding of what products are affected, including an understanding of the CVE’s root cause and potential impact. Poor vulnerability descriptions do more harm than good, and in a world where cyber attacks are increasingly more sophisticated, Microsoft needs to step up.

Cybersecurity.-microsoft,advisories,cybersecurity,users,businesses,vulnerability,patching