After fiddling with Brian Kreb's work yesterday, (available at SecurityFix) I decided to take it a step further and draw some pretty graphs. Here the patches were sorted into chronological order based on the date of the original report. It is interesting to note that Microsoft patches vulnerabilities reported at the end of the year faster than they do those reported at the beginning. In the graphs, blue lines are full disclosure vulnerabilities and the orange are responsible disclosure vulnerabilities. The full disclosure graph also shows the large improvement in patch times in those cases. I used a 5-point rolling average for the trend curves. It is interesting to note the cyclical nature of the Patch Times on the summary graph. There aren't just random spikes and troughs there are usually other highs and lows building up to them. It would be nice to know what projects were on at Microsoft that may lead to the general increase in patch times over that period, alternatively it could be the nature of the vulnerabilities. Any ideas?

Also in the last three years, Microsoft has:

• Released 99 critical patches
• Taken an average of 120 days to release a patch
• Taken an average of 62 days to release patches for full disclosure vulnerabilities

The original spreadsheet is available in:

• Open Office
• Excel
• HTML

I changed the day calculations so that they will work in Excel, however Excel is unable to display the graphs correctly and just shows two sets of bars instead of bars and a trend line, so I recommend either the OpenOffice version or the HTML.

As an aside, what are the correct terms for the two types of disclosure. Responsible disclosure is a rather morally laden term, and calling the alternative irresponsible or non-responsible seems silly. I am using 'full disclosure' in this entry, but it seems wrong.

While going over the research on Microsoft's time to patch produced by Brian Krebs at SecurityFix, I noticed a few things which didn't add up. His calculations for the number of days from internal or full disclosure until patch release appeared wrong. On double checking it seems they were. The calculations for 2005 were particularly bad with a total of 118 days going missing or being added. There are many off by one errors and in one case the disclosure date was listed after the patch release date, once the year was changed from 2003 to 2002 it made sense. For both 2003 and 2004 the number of patches were counted incorrectly! Given that the information was vetted by Stephen Toulouse of Microsoft, it is strange they they both missed this. The other possibility is that I have missed something, anyone care to double check my calculations? Brian has since seen this post and linked to it.

A spreadsheet is available with my calculations next to Krebs. In my corrected days column I have italicized and centered the days where my results and his disagree. I used Open Office's DAYS() function I just do a normal subtraction to calculate the difference in the days.

• Open Office Version
• Excel Version
• HTML Version

While the errors were sometimes quite large, the average calculations are not badly affected as the days were sometimes higher, and othertimes lower than they should be. The dates are still hugely useful, and all sorts of interesting information can be derived from them (eg1, eg2), it would be nice to have the same info for other vendors. Thus, the new summary is:

	2003	2004	2005
Number of Critical Patches	34	28	37
Ave. Days from Report to Patch	90.7	136	134
Ave. Days from Disclosure to Patch	73.6	55	46

UPDATE: added link to SecurityFix's follow-up post and Dan Geer's work

Brian Krebs at SecurityFix has done some nice research into the turnaround from Disclosure to Patch of all critical Microsoft Patches for the last three years (2003-2005). The summaries can he found at: 2003, 2004, 2005.

He contacted the original researchers and Microsoft to verify the dates and times, and Steven Toulous of the MSSRC vetted his results. The summary is:

	2003	2004	2005
Number of Critical Patches	33	29	37
Ave. Days from Report to Patch	90.7	134.5	133.5
Ave. Days from Disclosure to Patch	71.1	55	46

This shows that Microsoft has been taking longer to fix 'responsibly' disclosed vulnerabilities, most likely due to their increased testing regime, and fixing publicly disclosed vulnerabilities which they were not previously notified of faster. The increase is understandable and the marginal increase in risk is justified if the risk from faulty patches is greatly decreased. The decrease is a good sign, but 46 days is still way too long, a skilled attacker doesn't need underground sploits if they have that long.