• Microsoft's delay to patch fuels concerns
• .. and the debate keeps raging

Right Oracle has it horribly wrong, they keep doing this and really should just start fixing vulnerabilities that are reported to them. You can't sit on them indefinitely. Now Microsoft doesn't sit on them indefinitely but also seems to think they can hold on to patches for a fair bit of time.

The reason why you can't do this is simple: "We don't know if determined attackers can already exploit these vulnerabilities."

There are caveats to this of course. You don't want to rush out a poor patch that breaks everything, and you don't want to encourage reverse engineering of the patch. The first problem is easier than the second, there are numerous ways big companies can throw money at testing infrastructures to make the problem more of a hiccup. The second problem however seems to degrade into a tradeoff, patch asap and risk large scale worm type situations on the increased number of unpatched machines¹ or patch monthly and lower the number of mass compromises but increase the risk of determined attackers. Determined attackers are the worse kind, they are the kind who engage in espionage, sabotage and other sorts of clandestine activity.

Now in a world with on the ball security officers with decent edge defenses the second would be the best options, you would be patched before a mass compromise could occur and you could use edge defenses such as firewalls, IDS, anit-malware etc. to hold the fort during testing. I don't think that is an unattainable ideal. The other option makes it easier for your typical overworked sysadmin to patch and defend against automated exploitation, but leaves them vulnerable to the determined attacker.

If we had some knowledge of whether there are secret exploits out this would be an easier decision, but we aren't going to get hold of that information any time soon. So this leaves us in a situation where:

• Scheduled patching will result in less intrusions overall.
• ASAP patching will result in less (possibly more damaging) damaging intrusions in those organisations with good security practices.

UPDATE: Pete Finnigan, an Oracle security blogger finds this interesting. Thanks Pete.