Security experts in Asia have expressed little surprise over the software vendor's patch blunder, which caused users to get locked out of their PC, and prevented Microsoft's own Windows Firewall from launching.
Asia-Pacific chief security advisor, Microsoft
Said Neal Gemassmer, PatchLink's vice president for Asia: "With the overall complexity involved in trying to provide security patches on an ongoing basis, there are bound to be mistakes and faults to be found."
Ken Low, a senior manager for security at networking equipment maker 3Com, recalled that Microsoft had postponed its regular monthly patch update last month due to quality problems. "So I wasn't surprised that there were problems (with this month's update)," he said.
Low reckoned a significant number of Windows business users in the Asia-Pacific region would have been affected, and added that the urgency with which Microsoft pushed the bulletin would have also escalated the problem.
"What's really serious about this is that, when Microsoft released the bulletin last Tuesday, they told everyone to install the patches as soon as possible or risk having the vulnerability being exploited by worm writers," he said.
"So a lot of (their) customers took the advice, rushed to install the patches…and would have ended up with this problem."
And instead of pushing the blame to users for fiddling with the system's default settings, Microsoft should have offered more information on how the patch could affect machines that are configured differently, Low said.
More importantly, he stressed, patches should work regardless of how organizations tweak their machines. "They could have provided more information on what configuration to avoid (before getting users to download the patch)," he said. "Even then, Microsoft shouldn't be dictating how customers configure their systems but to provide a patch that works for all systems. It shouldn't be an issue."
Continuous learning for Microsoft
Kang Meng Chow, Microsoft's Asia-Pacific chief security advisor, acknowledged that the problems arising from the MS05-051 patch, showed that "there are more that we should, and can do" in the way the company handles security patches.
He added that improving the reliability of patches and a user's experience with them is "a continuous learning process".
Kang stressed this incident is not a step back for Microsoft, but rather, a useful lesson on how it can make "further progress in this area".
He noted that, based on feedback from customers, the number of people impacted by the flawed patch is "very low" and the problem can be resolved by following the directions provided on Microsoft's Web site.
"It remains critical for customers to continue to apply this patch to keep their systems updated, while taking precautionary steps to prevent occurrence of the 'side effects' by ensuring appropriate security permission setting for the COM+ Catalog director and files," Kang said.
PatchLink's Gemassmer is also optimistic that the problem is contained in this region, simply because Asian enterprises have yet to understand the importance of deploying patches quickly.
"At this point, what you'll find is that 85 to 90 percent of companies have yet to apply
Play video
There are currently no comments for this post.