Microsoft to help users prep for patching

Microsoft will give customers advance notice of its monthly security updates in an effort to help them prepare to install related software patches, the company announced on Thursday.

Starting this month, Microsoft will publish on its Web site a summary of planned security bulletins three days before they are released in their entirety. The summary will include information on which products are affected by updates, and severity ratings for security problems. The company normally releases security bulletins on the second Tuesday of each month. It previously offered advance notifications only to customers who signed up through its technical support programme.

"Giving customers advance warning is really the next stage in making security more predictable," said Gytis Barzdukas, director of product management in Microsoft's Security Business and Technology Unit. With the security guidance, companies can schedule the needed IT staff for the update release day, and can prioritise their activities according to how critical the updates are, he said. Barzdukas spoke in a phone interview from the RSA Conference Europe 2004 in Barcelona, where Microsoft offered an update of its ongoing security efforts.

The information will be available on Microsoft's TechNet website.

In addition to the notification service, Microsoft also said that it would deliver a beta version of its Windows Rights Management Services (RMS) Service Pack 1 (SP1) in the first half of 2005, and that it has started a partner validation programme for its Internet Security and Acceleration (ISA) Server 2004. The validation programme aims to assure customers of the interoperability of third-party products used with ISA Server 2004, and is being run in collaboration with VeriTest testing services, Microsoft said.

Barzdukas said that the announcements were of particular interest to European users. The RMS service pack, for instance, adds improved authentication by smart cards, and the ability to be deployed without a network connection to the Internet.

"There's a lot more use of smart cards and token authentication in Europe, so we saw a lot of demand for these capabilities here," Barzdukas said. Additionally, European customers were interested in running RMS on servers not connected to the Internet, he said.

"We've moved away from the old model and are offering them control of their data on disconnected servers," Barzdukas said. The ISA Server 2004 validation program also addresses the tendency of Europeans to use more hardware security products than North American users, Barzdukas said. "Basically what we can do is go deeper and richer into packet inspection to help manage hardware," he said.

The announcements come as part of increasing efforts by the software maker to show that it is serious about security. Earlier this year it delivered the much-anticipated Windows XP Service Pack 2, which Barzdukas dubbed as the "largest automatic download of technology ever".

Since its August launch, more than 110 million customers have downloaded Windows XP SP2, Microsoft said on Thursday.