Software News – netfordownload.com

Security expert: Microsoft should cut IE’s links to Windows

Microsoft would better protect users by severing Internet Explorer’s connections to Windows, then patching the browser invisibly in the background — daily if necessary, a security expert argued Tuesday.

Microsoft patches flaw that could compromise, cripple Exchange

“The browser is the heaviest-used application that interacts with the Internet, and the most likely source of malicious content. IE vulnerabilities should be given the highest priority and patched first,” said Wolfgang Kandek , CTO at security company Qualys Inc.

But that’s not what happens in the real world, he said. “Unfortunately, the vulnerability data that we collect shows that companies treat browser patches just like all other patches. IE’s patch deployment cycle correlates very closely with other critical patches.”

According to data Qualys collected from scans of several hundred thousand Windows PCs owned by its customers, the patching pace for IE vulnerabilities was essentially the same as the rate at which users fixed other non-IE critical flaws.

To pick up that pace, Kandek suggested that Microsoft sever Windows’ links to IE completely, then boost IE’s update frequency and take some, or all, of the control out of users’ hands. “There’s just too much user interaction required by Microsoft for IE,” he said, referring to the way Microsoft updates its software, IE included, using services such as Windows Update.

“If Microsoft removed IE from Windows and made it independently updatable, I think you’d get improved update performance,” said Kandek.

Although pulling IE from Windows would mean that Microsoft would have to come up with a different mechanism for Windows Update — currently the service relies on IE — Kandek believes the benefit to users would be significant. “Taking IE out of the [monthly] patch cycle would give us better protection,” he said.

Rather than patching IE only once a month , as it does now, Kandek would like to see Microsoft pick up the pace by rolling out fixes as soon as they’re ready, in effect mimicking the update process that Mozilla Corp. uses for Firefox , or the even less intrusive approach that Google Inc. applies to its Chrome browser.

Firefox users receive a notice when security updates are available, and can click through to download and install the patches. Chrome users, meanwhile, do nothing: Google pushes patches to its browser automatically, and they’re installed with no user action required. Either method would be preferable to Microsoft’s current update strategy for IE.

Source: networkworld.com