Microsoft to Offer Patches to U.S. Govt. First

Quote:

---

Microsoft Corp. is to give the U.S. government priority in fixing security holes in Windows and other software, The Wall Street Journal reported on Friday.
Under a plan to take effect later this year, Microsoft will give the U.S. Air Force versions of software "patches" to fix serious security vulnerabilities up to a month before they are available to others, the paper said.

The U.S. Department of Homeland Security will give advance notice of problems to other government agencies and distribute patches to them, the Journal said, citing officials at Microsoft and the White House's Office of Management and Budget.

---

Source : http://www.reuters.com/newsArticle.j...technologyNews

Heh, I already knew this. As a member of the World's Finest (USMC), I am glad that the Dept of Homeland Security is looking out for the DoD. An individual may or may not like Microsoft products, but you can only use what the majority of your users are familiar with. It would be great if all my users knew a thing or 2 about Unix or Linux, hell... I'd even settle for one of my users not shrugging when I use the phrase command line interpreter. Oh well...

Quote:

---

The U.S. Department of Homeland Security will give advance notice of problems to other government agencies and distribute patches to them

---

Meaning other United States agancies? Or different countries? What about Europe, or Canada? They aren't going to get the patches if they need them like the US gov.?

It's not that I don't agree with the idea, I think they govs. should get the patches first, else there could be a major breach, but what about other countries?

microburn

I'm sure Microsoft would make patches readily available to any other countries' governments as well assuming that the right people were contacted. Just understand that the US Dept of Homeland Security is being as proactive as possible. The individual consumer can't really complain to Microsoft about lack of availability if their own country adopts a "reactive" vice "proactive" stance on information security.

Not cracking on your Canadian location, so much, but they may not view Cyber-Terrorism as a threat to you hosers, eh? <--- Sorry, I couldn't resist. :D

Cheers!

what do you think the odds of one of these gov employees digging into these patches and releasing some strain of virus/exploit based on it? I mean government or not every place of employment has employees who do things they shouldnt and have employees who are disgruntled or just plain unhappy. What are the odds of something else coming from this?

Is a simple patch given ahead of time going to cause people to suddenly get clues on how to crash/bash systems? Geez, they have an entire operating system and patches at their disposal now. If they are so smart, let em crash the machines that haven't patched already.

I don't see individual departments, let alone any department of the US Government saying to foreign Governments "Oh..you have that problem too?? ...well gee....here's an itsy bitsy teenie weenie little patch to fix that right up now...It's an advanced patch so don't be telling anyone about it, ya hear??

I think the odds of something bad coming out of this is....well...zero to none.

I agree that it'll make little or no difference...this sounds like an attempt by Billy-bob to earn some governmental brownie-points by suckin' up to the brass...
after all his dealings with governmental agencies he's now laying on a little butter to smooth things over and get a few favors into his pocket before the next time his ass gets into a sling.

Quote:

---

Originally posted here by ZT3000
.....

I think the odds of something bad coming out of this is....well...zero to none.

---

I disagree completely. The difference being here is if a new update comes out a month before it is released to the normal public, a skiddie/virus writer gets ahold of it, realizes the potential and releases it..... now only the government pcs that MAY have gotten the update will not be affected, but EVERY other windows based pc is.... not just some of them, a lot of good admins stay on top of patches and security updates testing and implementing them as soon as they can, but you take a month old problem that you dont have a patch for and someone releases a POC or exploits in some way I think you may be looking at another blaster problem but perhaps on a larger scale since noone has the update yet.

Just my 2 cents

You know, another way of looking at this is -

M$ is getting free beta testing from Uncle Sam...

Hmmm..................

So people who control thermonuclear weapons get software that Micro$h1te dare not release to the commercial market?

Oh great...................

:rolleyes:

I see it from the point of view that presumably if MS is able to offer a patch to the US government that means that the patch is ready to be released. So I take it from that that normal users are not good enough to receive patches on time because it can't possible take a month to get the patches onto windows update or whatever distribution media.

The conspiracy theory side of my starts to think that they're deliberately going to release patches late so that the US government can break into ppls computers easier :P

ac

Ah, but they don't say that, do they? I bet the US govt is getting the patch that hasn't been seriously beta tested...as just mentioned...free beta testing with MY tax dollars, damnit!

The life you know, all the stuff you take for granted it's not going to last,
Imagine a world of permanent darkness, where machines control mans destiny...

Rise of the machines, "Terminator" hehe

This is simple lipservice to make MS look extra patriotic.

Two important things to consider:

1. Microsoft Products are not found on any government systems that are used to secure anything important.

2. "Microsoft will give the U.S. Air Force versions of software "patches" to fix serious security vulnerabilities up to a month before they are available to others"

We can draw a few conclusions from this data. First, who cares if the systems are secure, their exposure factor is practically nil. Second, these priority patches are likely to be incomplete, in that they only work for a pre-defined set of configurations. A universal patch may be one in the same, may follow in an hour, a day, but no more than a month.

Note, I make no mention of exotic government developed viruses, no untested software, and nothing implying the insecurity of the US's nuclear arsenal. Why? Ockham's razor aka "the economy principal" look it up if you don't know.

catch

Be careful when using Occam's razor, it will cut you quite quickly. It *might* be that MS is just wanting to do something nice for Uncle Sam, but I seriously doubt that too.

Personally, I see one of two economic possibilities - and going by that same razor and least hypothesis, I find:

Either MS is out to get its software on all government machines and not just the unimportant ones, thereby making huge profits, or they're using the government for a beta testing platform since they're on unsecured machines anyway, and there's some pretty damn good techies employed by the feds.

Both reasons wind up making $ for MS, either in the form of higher sales or in free research.

What I most question is what does the government get out of the deal other than an early patch?

Well, I have developed beyond medaeval philosopy.............."Occam's razor"............jeez!.........this IS the 21st. Century is it not?

Quote:

---

For example, through two data points in a diagram you can always draw a straight line, and induce that all further observations will lie on that line. However, you could also draw an infinite variety of the most complicated curves passing through those same two points, and these curves would fit the empirical data just as well. Only Occam's razor would in this case guide you in choosing the "straight" (i.e. linear) relation as best candidate model. A similar reasoning can be made for n data points lying in any kind of distribution.

---

So anyone with even a modicum of lateral thinking capability (thinking outside the box) will be using Gillette for a shave, not Occam :D

|3lack|ce seems to have cut a lot closer to the chase, in that I strongly suspect that it is a Microsoft aggrandisement scheme..................was it not only a few weeks ago that we heard that the US military were ordered NOT to accept "free trial" MS Office software?

:)

Ockham's Razor simplified: "If you live in the US and you hear hooves, think horses, not zebras." that is all things being equal, the simplest solution is most likely the correct one. Is it always the correct one? Nah, but most times it is. (expanded as: http://phyun5.ucr.edu/~wudka/Physics...ww/node10.html )

http://pcp.lanl.gov/OCCAMRAZ.html - You should be negged Nihil for misusing a quote out of context to make a different point, but I am feeling nice. Please use data more appropriately in the future.

Let's look more at other possibilities presented:

Quote:

---

Either MS is out to get its software on all government machines and not just the unimportant ones, thereby making huge profits

---

This would take a dramatic change (http://www.trustedsystems.com/b-level.htm ) in Windows. Important (ie. high assurance) systems need to met specific requirements, it is more than just having the right marketing technique. Microsoft knows this, the US government knows this, many outsiders do not know this and thus what may seem like a viable possibility is in fact... not.
Next on the docket:

Quote:

---

or they're using the government for a beta testing platform since they're on unsecured machines anyway, and there's some pretty damn good techies employed by the feds.

---

The government actually has very few "good techies" for the simple reason that government pay is garbage. They do however have many brilliant researchers working for them directly (national labs folks) and contracted (MITRE among others) but these people would be in no way dealing with the modification of commercial off the shelf software.
Furthermore, (and this is key) what happens if say VISA gets compromised by an exploit in-between the government release and the commercial release? Microsoft is in huge trouble... unless as I stated the government patch is only targeted at specific pre-defined configurations with a general purpose patch to follow.

Basically all Microsoft has done is developed a new method of releasing patches. This way organizations that follow the configuration guidelines will get faster patching than the current system and organizations that have poor or exotic configurations stay on the current system. This gives Microsoft greater implied control over end systems which will ensure that a greater number of systems are configured in a secure manner (with the reward of more rapid patching) and this in turn will lower the number of Microsoft compromises giving the appearance of greater security.

Why start with the government? Because an initial large client that doesn't respond to typical advertising is much cheaper than a huge campaign to get the word out to corporate America.

cheers,

catch

It would seem to me that a lot of people are making assumptions and comparisons without really understanding how the current MS patch process works. I've posted this before, but I'll go ahead and post it again.

There are basically three stages to a patch in the MS way of doing things. A service pack is moreso just a collection of patches that has been through more testing.

dev patch- the patch, as created by the developers, that they believe will fix the problem. Very little, if any, testing has been done on a patch at this particular part of its life-cycle.

buddy patch or buddy drop- This is the stage that indicates that the patch has been tested to fix the problem in the MS labs, and it does not appear to cause any major issues. If you call MS and report a new bug to them they will ask you to apply a buddy patch to help them test that it actually fixes the problem before giving the hotfix an official status. I never install buddy patches as they have not been fully regression tested and if your environment is even slightly different than what was tested in the lab you can have major issues. I would guess that this is the stage the patches will be in when the US government gets them. For the issues that I have reported to MS, and subsequently received a patch for, I would say that a patch is probably going to spend anywhere from 2-6 weeks in the buddy drop status. Depending on how quickly it can be tested.

Official hotfix- The patch has been tested but it is not recommended that you install the patch unless you have experienced the issue, or if not installing the patch results in a security risk. The biggest issue with this level of a patch is even though it has been tested it has not been tested as much as say a service pack, or a .0 release.

Service packs- a collection of hotfixes that have been fully tested to insure interoperability with one another. Even though this is the most tested form of a patch you could still have issues.

I guess that the buddy drop will be what the government is getting mainly because MS does not hold up critical hotfixes once they are ready to be deployed. The only case where they would hold one up would be if it was finished shortly before the official MS Patch Tuesday for that month. If you have a premier contract and you are having issues and MS has a buddy patch available for that issue, they will offer it to you. Even if that means that you get a security patch weeks before it is going to be released.

If they are indeed getting buddy patches I have no problem with that. If, however, MS is holding up production ready patches just to let the DoD servers get a leg up on everybody else I would have an issue with that. I have no problems with patches being distributed to the critical infrastructure stuff first, for instance the Cisco SNMP patches from then end of 2003. I just think this should be done an a per case basis.

MS just wants to stop or more appropriately slow the infection of open source and linux. And continue to reap the huge licensing contracts over concerns of security and financial backing.???