Locations

United StatesChangeAll Microsoft Sites

Search

Print Email Share
Print Email Share

MSRC 10 Year History

On January 15, 2002, Bill Gates sent a companywide memo stating that Microsoft must make trustworthy computing the highest priority for the company over the next decade. A key element of Microsoft’s increased focus on securing our customers is the work carried out by the Microsoft Security Response Center (MSRC). To mark the 10-year milestone of Gates’ memo, we are highlighting our efforts made in security response, industry collaboration and the security ecosystem.

The monthly security update process, driven by the Trustworthy Computing Group, is one of the most visible components of Security Response at Microsoft.

Our software developers follow the Microsoft Security Development Lifecycle (SDL), the most comprehensive and effective software security assurance process in the industry to help build software with fewer, less severe, vulnerabilities. However, as with any major software product, vulnerabilities may be discovered in the product code. Once a vulnerability is reported, we begin to investigate and, if necessary, work with the product team to develop a security update that addresses the vulnerability. After extensive testing, we release these security updates publicly on the second Tuesday of each month.

We introduced our monthly release cycle in September 2003, providing customers with the following benefits:

  • A predictable schedule that helps customers plan for security update deployments.

  • A reduced number of updates, combining issues when possible.

  • Improved overall quality of security bulletins, which, coupled with the predictable release schedule, allows customers to employ a more refined production and testing process.

In 2005, we built comprehensive testing into our development process when we introduced the Security Update Validation Program (SUVP), allowing us to test security updates in customer lab environments.

We launched the Advance Notification Service (ANS) that same year, to provide customers with information describing affected products days before the release. ANS helps IT professionals prepare a deployment plan.

In 2008, the Exploitability Index was introduced which predicts whether a vulnerability might be exploited for remote code execution within 30 days after a bulletin is issued. At that time, we also began publishing more technical details about the monthly security bulletins to the Security Research & Defense (SRD) team blog.

Managing Bulletins: Inside world of a MSRC case manager.
Leading The Way: The role we play as a security leader.

Industry Leading Incident Response

Occasionally, a vulnerability may be exposed publicly or discovered in active attacks before we have the opportunity to address it. For example, issues like Code Red, Nimda, SQL Slammer, and the infamous Blaster and Sasser worms demonstrated the need for a team to marshal company resources to enable quicker response and resolution.

How SSIRP Works: Software Security Incident Response Plan.

Phases of Incident Response. Click to enlarge.

To combat potential threats, we launched the Software Security Incident Response Plan (SSIRP) in 2003. SSIRPs are used to understand security incidents quickly, and then investigate, analyze, and resolve those incidents. The MSRC provides customers with the necessary information, guidance, mitigation steps, and tools to help them react appropriately.

After a security update is released, the SSIRP team continues to monitor the threat landscape, working with our worldwide teams to help address any deployment issues that customers may encounter.

Inside Incident Response: Mike Reavey discusses our approach.
Was This Information Useful?