Windows 10: Inside the MSRC - The Monthly Security Update Releases

Brink · Feb 14, 2018

For the second in this series of blog entries we want to look into which vulnerability reports make it into the monthly release cadence.

It may help to start with some history. In September 2003 we made a change from a release anytime approach to a mostly predictable, monthly release cadence. October 2003 ushered in what became known as Update Tuesday. How and when Microsoft releases new products and services in market products has changed over the years, but the monthly delivery of security content has remained steady.

So how do we decide what goes into a monthly security release? That decision largely rides on required customer action and risk. Required customer action is realized through products where customers need to take action to protect themselves against a vulnerability. For consumers, protection is accomplished through automatic updates. Not all of Microsoft’s offerings require customer action and are accordingly not part of the monthly cadence. In the next blog entry we will talk about online services cases which are the main class of reports not addressed on Update Tuesday. To assess risk, we utilize our security bug bar as established by the Security Development Lifecycle (SDL). Every vulnerability report is triaged against that bar and assigned a severity – critical, important, moderate, low, or defense in depth. We prioritize critical and important class vulnerabilities to be addressed in our monthly update cycle.

Lower severity vulnerabilities are typically considered for next version (v.Next) releases. Those may or may not be backported to platforms currently in support depending on their impact. On occasion lower severity vulnerabilities will be addressed in a monthly update, but those are more opportunistic updates where additional fixes for higher severity vulnerabilities were already releasing that month. For more information on what is in support and our support lifecycle, please visit https://microsoft.com/lifecycle. Later in this blog series we will discuss the v.Next process, how that has evolved over the years of our release cadence, and what researchers can expect from reports that fall into these classes.

The combination of all of these processes are what customers experience as our Update Tuesday cadence. The releases represent the highest risk vulnerabilities. We document the fixes with the risk information so customers can better make informed decisions for their environments. More information on how we create security updates can be found here: Security Update Lifecycle. For security researchers, these releases show their research and collaboration with Microsoft to better protect customers together.

In our next blog entry, we will explore vulnerability reports and resolution in our online services space.

Phillip Misner,
Principal Security Group Manager
Microsoft Security Response Center
Click to expand...

Source: Inside the MSRC - The Monthly Security Update Releases MSRC

:)

Gerry C J Cornell · Feb 14, 2018

cumulative update

February 2017 security update release delayed February 2017 security update release

Gerry C J Cornell · Feb 14, 2018

Failed to install KB3213986

February 2017 security update release delayed February 2017 security update release

Windows 10: Inside the MSRC - The Monthly Security Update Releases

Inside the MSRC - The Monthly Security Update Releases

Inside the MSRC - The Monthly Security Update Releases

Inside the MSRC - The Monthly Security Update Releases - Similar Threads - Inside MSRC Monthly

PROBLEM MSRC

Microsoft Security Update Release

MSRC Recognizing Security Researchers in 2020

Announcing 2019 MSRC Most Valuable Security Researchers

September 2017 security update release

Inside the MSRC - How we recognize our researchers

August 2017 security update release

MSRC 2017 list of Top 100 security researchers

May 2017 security update release