News

Microsoft Security Report Released

• By Jabulani Leffall
• November 06, 2009

Security experts commented on Version 7 of Microsoft's Security Intelligence Report (SIR), which was announced this week.

The report covers software security from January through June of this year, finding that of all threat categories, worms grew the most in 2009. However, trojans still hold first place as the most wide-ranging and prevalent threat. One striking finding is that worm infections "in the enterprise rose by nearly 100 percent during the first half of 2009" compared with the preceding six months.

Tyler Reguly, a senior security engineer at nCircle, suggested that the data in the report isn't granular enough and that the Microsoft still appears to be reacting to threats.

"More than anything else, the MS SIR tells us, once again, that Microsoft is serious about security, but like any company, they're also serious about marketing," Reguly said. "So like any vendor report, these numbers must be taken with a grain of salt."

One prime example, Reguly contends, is the number of security bulletins being issued. Microsoft's numbers are based on public bulletins and disclosed vulnerabilities, which isn't the full picture.

"The report discusses the bulletins at great length," he said. "Yet it does not have a section discussing internally discovered and silently patched vulnerabilities. If this were reported, some of these statistics would have started to change."

The also report doesn't reflect some of Microsoft's newer important software releases, noted Donald Retallack vice president of systems management and security research at Directions on Microsoft.

"This report does not cover the periods after Microsoft Security Essentials or Windows 7 was released," Retallack said. "It should be interesting to see the next version [of the report] since Microsoft will have data from those products."

For SIRv7, Microsoft gleaned data from more than 450 million computers worldwide and billions of Web page scans over six months. It included information captured from Windows Live OneCare and Windows Defender, operating on more than 100 million computers worldwide.

Top threats, according to the report, were the Conficker and Taterf worms. Conficker was a thorn in many an IT pro's side running Windows environments.

Microsoft tried to slow Conficker in October of 2008 with an off-cycle patch, but it still managed to infect five million PCs worldwide before going nearly dormant in the late spring of 2009, according to Microsoft's report.

Taterf was the second most prevalent threat worldwide, according to the report, with detections "increasing 156 percent" compared with those found in the second half of 2008. Taterf mostly infected the PCs of online gamers.

The report lists some best practices for ensuring software security based on the results of countries with the lowest infection rates, including Austria, Germany and Japan. Retallack suggested that IT pros could find some tips there.

"The regional differences in vulnerabilities found suggest that global companies should pay attention to the new best practices section of the report," he said.

More generally, Microsoft recommends making sure that patch bulletins are fully understood and that third-party applications are updated and safe. IT administrators should have a formal "security assurance process" in place, as well as procedures for monitoring the use of removable media and file sharing.