Yesterday, Microsoft published the new Security Intelligence Report for the 2nd half of 2007. (home page is http://www.microsoft.com/sir, and the download page is here).

As one of the contributors for the report, I'd like to highlight the findings summary for the Industry vuln trends:

• Vulnerability disclosures decreased by about 5 percent in 2007, reversing a multiyear trend of increasing disclosures. Almost all of this decrease was observed in the second half of the year, which had the fewest disclosures since 2H05.
  
• Despite the decrease, the number of new disclosures across the industry remains in the thousands, with the number of disclosures in 2007 surpassing that of every other year in the study except 2006.
  
• The Common Vulnerability Scoring System (CVSS) used to score vulnerabilities in the NVD was revised in 2007 to increase its accuracy, consistency, and applicability. Retroactively applying the new formula to vulnerabilities disclosed in previous years classifies a much higher percentage of vulnerabilities as High-severity than was previously
  the case. The vulnerabilities disclosed in 2007 continue this trend, with High-severity vulnerabilities accounting for about half of the total number of vulnerabilities.
  
• Vulnerabilities requiring a Low-level of complexity in order to exploit accounted for
  about half of all vulnerabilities disclosed in 2H07. Although this number is relatively
  large, the number has declined significantly from earlier periods.

Here is the high level trend chart from the report:

Regards ~ Jeff

The discussion led the FTC to suggest last month that Web advertisers using behavioral targeting consider adopting several privacy principles, called "Governing Principles For Online Behavioral Advertising" (The Principles are excerpted below). The FTC has suggested that these should be considered for implementation as private sector self-regulation in the same way that earlier online privacy principles had been adopted by the US private sector self-regulation in response to the Safe Harbor agreement to meet the privacy mandates of the European Union’s Data Protection Directive. The FTC is presently soliciting private sector comment on these principles and their impact on online commerce.

FTC-proposed Governing Principles For Online Behavioral Advertising Privacy

To address the need for greater transparency and consumer control regarding privacy issues raised by behavioral advertising, the FTC staff proposes:

• Every Web site where data is collected for behavioral advertising should provide a clear, consumer-friendly, and prominent statement that data is being collected to provide ads targeted to the consumer and give consumers the ability to choose whether or not to have their information collected for such purpose.

To address the concern that data collected for behavioral advertising may find its way into the hands of criminals or other wrongdoers, and concerns about the length of time companies are retaining consumer data, the FTC staff proposes:

• Any company that collects or stores consumer data for behavioral advertising should provide reasonable security for that data and should retain data only as long as is necessary to fulfill a legitimate business or law enforcement need.

To address the concern that companies may not keep their privacy promises when they change their privacy policies, FTC staff proposes:

• Companies should obtain affirmative express consent from affected consumers before using data in a manner materially different from promises the company made when it collected the data.

To address the concern that sensitive data – medical information or children’s activities online, for example – may be used in behavioral advertising, FTC staff proposes:

• Companies should only collect sensitive data for behavioral advertising if they obtain affirmative express consent from the consumer to receive such advertising.
• FTC staff also seeks comment on what constitutes “sensitive data” and whether the use of sensitive data should be prohibited, rather than subject to consumer choice.

The staff is seeking additional information about whether tracking data is being used for purposes other than behavioral advertising and whether such secondary uses, if they occur, merit some form of heightened protection.

These principles and the US self-regulatory approach to the issue of behavioral advertising were presented this month to the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs. The committee was considering the privacy policy implications of   

"..."behavioural marketing" founded on computerized data collection and on targeted advertising which are creeping into nearly every aspect of the social and commercial transactions – searching, browsing, networking, emailing and telephoning. This new situation, however, raises some critical issues about the sufficiency of  companies’ disclosures, the level of consumers’ understanding and control of their personal information as well as the security and confidentiality of the massive amount of sensitive personal data. Moreover, behavioral marketing directed at vulnerable individuals, such as young people and teens, clearly raises the question of the degree of privacy protection."

These discussions are preparatory to the pending update of EU Directive 2002/58/EC on data and consumer protection in the telecommunication domain by the Article 29 Working Party of the EU Directorate General for Justice, Freedom and Security. This group also is currently preparing a report on how well the privacy policies of the search engines of Google, Yahoo!, Microsoft, and others comply with the mandates of the EU’s Data Protection Directive.

A comment made by the chair of this group during the parliamentary meeting this month suggested that the Article 29 Working Party is considering implementing into EU policy that the Internet Protocol (IP) addresses associated with a specific person will be considered to be "personal data" and thus subject to the legal protections provided under the EU Data Protection Directive.

If this position should in fact become the basis for EU privacy policy, it could have enormous implications for Internet search engine operations within EU nations and may also impact the provisions of the US Safe Harbor agreement with the EU. This blog will track this activity as it unfolds and update events as they occur. Stay tuned.

This paper analyzes the vulnerability disclosures and security updates for the first year of Windows Vista and looks at it in the context of its predecessor, Windows XP, along with other modern workstation operating systems Red Hat, Ubuntu and Apple products.

The results of the analysis show that Windows Vista has an improved security vulnerability profile over its predecessor. Analysis of security updates also shows that Microsoft improvements to the security update process and development process have reduced the impact of security updates to Windows administrators significantly compared to its predecessor, Windows XP.

Share this post :

As one of the primary authors for the vulnerability trends information, I will be hosting one of the webcasts on November 1, 2007 and you can register here:  Microsoft Security Intelligence Report: Overview of Latest Trends in Vulnerabilities and Malicious Software (Level 100).

If you want to quickly download the report in pdf, click on this link.

There are lots of interesting results (with charts) in the SIR and I encourage you to look the whole report.  However, here are a few of the things I would call out to you.

The number of disclosures of new software vulnerabilities across the industry continues
to be in the thousands, with more than 3,400 new vulnerabilities disclosed in
1H07. But this number actually represents a decrease from 2H06, the first period-to-period
decline in total vulnerabilities since 2003.

Note however, another trend as shown in the chart.  High severity vulnerabilities continue to grow significantly, while the overall total flattened out.   In the full report, you'll also note a trend reversal with complexity to exploit dropping as well.

There are a couple of other interesting results that I want to call out that you should examine with more detail in the full report

• Social engineering plays a growing role in overall malware attack techniques.  This is a key result since even with vulnerability-free software, these techniques could succeed against users of any platform.
• Windows Defender has proportionally detected 2.8 times less potentially unwanted software on computers running Windows Vista than on computers running Windows XP SP2, based on normalized data.   This is a practical measure of benefit that is somewhat more valuable in my opinion than vulnerability comparisons.

That is enough teasers. Download the report at www.microsoft.com/sir.

Regards ~ Jeff