Valentine's Day Patch Tuesday: Microsoft to issue 9 patches, 4 critical

Microsoft Thursday said that the second Patch Tuesday of 2012 will see nine security bulletins, four of which were deemed critical.

Three of the four critical bulletins address vulnerabilities in Windows, one of which also targets an Internet Explorer flaw that Wolfgang Kandek, CTO of Qualys, says should be treated with the "highest priority." This is because browser-based vulnerabilities have been exposed more quickly of late than those for legacy software, Kandek says.

The fourth critical bulletin targets the .NET framework and Silverlight. As for the remaining bulletins, all five are rated "important." Four address vulnerabilities in Windows while another resolves an issue with Office and Server Software.

With the release, Microsoft will exceed the seven bulletins issued last month, as well as nearly tripling the number of vulnerabilities addressed, from eight in January to 21 this month.

RELATED: Microsoft patch blows 'perfect game' but sends important message

However, when the trends of the past few years are taken into account, the second Patch Tuesday of 2012 is a sign of continued progress for Microsoft security. Paul Henry, security and forensic analyst at Lumension, called this Patch Tuesday a "pretty sweet Valentine's day" for the IT professionals responsible for implementing the bulletins, especially when compared to the last two years. Microsoft sent 12 patches and addressed 22 vulnerabilities in February 2011, a year after issuing 13 bulletins that addressed 26 vulnerabilities.

Especially coming off a similarly light January Patch Tuesday, in which seven bulletins were issued but just eight vulnerabilities were addressed, Henry says there are signs of optimism for Microsoft security.

"We've had two fairly light patching periods in a row, with just seven from Microsoft last month," Henry says. "Clearly, the company's renewed focus is paying off."

Tuesday's upcoming patch will bring the total number of security bulletins in 2012 to 16. In comparison, Microsoft had issued 14 combined patches in the first two months of 2011, following a light, two-patch month in January 2011.

Despite the slightly higher total in overall bulletins compared to the same time last year, Henry has said security improvements in updated versions of Microsoft products have been evident in the continued decline in security patches. In 2011, Microsoft issued 100 patches, down from 106 the year prior. The company also saw its lowest level of bulletins rated critical in 2011, at 32, since it began issuing them monthly in 2004.

Colin Neagle covers Microsoft security and network management for Network World. Keep up with his blog: Rated Critical, follow him on Twitter: @ntwrkwrldneagle.

Read more about software in Network World's Software section.

Tags: internet explorer, Microsoft, Microsoft Patch Tuesday, operating systems, Patch Tuesday, qualys, security, software, Windows, Windows security

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CSO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
CSO Corporate Partners
  • FirEye
  • Clear Swift
  • Trend Micro
  • Sophos
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Sophos SafeGuard Enterprise

Your central key for data protection

more »

Submit your own security event

Submit your training courses

Security Awareness Tip
Software security company www.clearswift.com gives some advice this holiday season to make sure employees don’t end up on Santa’s naughty list!


At a fundamental business level, social media is a useful additional tool for communicating and collaborating with customers, colleagues and new business prospects. From an HR point of view, the social web is not only useful for recruitment but also as a knowledge network. At an employee level, social media is changing the way we work: Employees increasingly expect to be able to access personal technology and services in the workplace. As the lines between work and home life blur, staff are looking for greater flexibility in their roles; working from home is an increasing trend, but so too is ‘home-ing from work’, where staff expect to be able to perform personal tasks at work.

But social media brings risk and reward to business in equal measure. Information security is a key concern: Many organisations view social media channels as yet another route along which sensitive data can escape from the business, whether accidentally or maliciously. On top of this, senior management may be concerned about the amount of time employees spend on social networks.

This cultural shift raises new questions about trust in the workplace, the balance of power in employer / employee relationship and levels of control over people and content.


Organisations using content and web security technology can manage the way their staff use email and the internet without having to resort to a default position of mistrust. With a whopping third of ANZ employers completely blocking social media access at work, there’s a real danger of throwing the benefits of collaboration out with the risks.


It doesn’t have to be that way.

Trust breeds responsibility: People underestimate the amount of company time they spend on personal browsing. Allow staff to view their own web usage and foster more responsible behaviour without undermining trust.


Know limits: Set clear limits on personal surfing and communicate them to users. Alert them when they are approaching their limit. Help your people to play by the rules.


Share the load: Spread responsibility for usage reporting among managers and department heads so everyone gets to see how their usage impacts on the rest of the organisation. This also gives managers greater control and visibility into usage.


Need to know: Yes, you need reports and visibility. What you don’t need is employee data becoming common knowledge. Access control means reporting can be adjusted on a need-to-know basis.


Security ABC Guides

7 Ways to Protect Your Business Printers

Can a hacker burn down your business by remotely setting one of your printers on fire? Researchers at Columbia University have recently proposed such a scenario, although HP quickly denied that it's possible. However, even if your printers can't be used as remote firestarters, there are many risks involved in networking a printer.

Read More
more »