Vulnerabilities / Threats
7/29/2013
04:34 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner

Microsoft Active Protections Program evolving to a protection, detection, and remediation program

LAS VEGAS -- BLACK HAT USA 2013 -- In its latest effort to narrow the attack window, Microsoft has fine-tuned and expanded its vulnerability information-sharing program for vendors to include security incident responders.

Click here for more of Dark Reading's Black Hat articles.

In a series of changes announced today to the Microsoft Active Protections Program (MAPP), Microsoft now will provide vendor members intelligence on newly found bugs in Microsoft software sooner -- three business days prior to Patch Tuesday -- to give them more time to prepare and test signatures. To date, MAPP has given them a 24-hour jump on Patch Tuesday. The program also now will offer a validation system, where vendors can assess their detection tools for new Microsoft bugs before they distribute the tools.

And MAPP is no longer for vendors alone: Microsoft is now offering a MAPP program for incident responders as well, where Microsoft will provide them with attack intelligence and an intel-sharing forum to safely share attack particulars, such as malicious URLs, file hashes, and other incident data. CERTs, government entities, and private organizations are the audience here, according to Microsoft. "More incident response companies are spinning up, and CERTs are requiring this information," says Jerry Bryant, senior security strategist for Microsoft's Trustworthy Computing group. "This will facilitate information and response exchange, and start with information we have based on threat indicators ... the biggest goal here is to facilitate the exchange of threat information."

It all boils down to the new reality for organizations today: that attacks from determined threat actors are inevitable, so detection of malware and infiltration are key to recovering and remediating as soon as possible. "This is just the beginning of a lot of changes we're making under MAPP," Bryant says. "Our goal is to move the program from just a protection program to a protection, detection, and remediation program."

Microsoft has been forging closer ties with outside security researchers during the past few years, starting with its Blue Hat Summit, then the Blue Hat Prize in 2011, which awarded researchers with cash and prizes for coming up with defense mitigation methods, and, most recently, its game-changing, three-part bug bounty program launched late last month. The software giant has received 19 submissions for the bug bounty program as of July 17.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante.]

Microsoft also is now offering a free cloud-based MAPP Scanner tool that scans documents, PDFs, and URLs for what it calls "content-based" attacks. The Azure-based cloud service is currently in beta with MAPP vendor and response partners, who submit documents or URLs for scanning, which is processed in a virtual machine. The service is based on an internal tool used by Microsoft to analyze suspicious documents.

"The advantage of the MAPP Scanner is that it focuses on unknown vulnerabilities," Bryant says. "It's based on a tool we use in our content-based investigations. Our intention was to provide it to the response community at no charge."

The scanner service provides "active analysis" to discern whether a file is attempting to exploit a bug, and the goal is to pinpoint new attacks and attack vectors.

"What we're doing with MAPP is part of our overall strategy for protecting customers," Bryant says. "We want to get as many exploits off the street as possible, and then we can work on remediation. The partner programs we have under the MAPP moniker are the vehicle" for this, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ashu001
50%
50%
Ashu001,
User Rank: Apprentice
7/30/2013 | 6:36:20 PM
re: Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner
Microsoft deserves all the Credit they get here.

Very impressive compared to the Lack of attention that Apple pays to this space;Microsoft continues to win Hearts and Minds here!
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.