Microsoft Extends MAPP To Incident Responders And Offers Free Online URL, File Scanner

LAS VEGAS -- BLACK HAT USA 2013 -- In its latest effort to narrow the attack window, Microsoft has fine-tuned and expanded its vulnerability information-sharing program for vendors to include security incident responders.

In a series of changes announced today to the Microsoft Active Protections Program (MAPP), Microsoft now will provide vendor members intelligence on newly found bugs in Microsoft software sooner -- three business days prior to Patch Tuesday -- to give them more time to prepare and test signatures. To date, MAPP has given them a 24-hour jump on Patch Tuesday. The program also now will offer a validation system, where vendors can assess their detection tools for new Microsoft bugs before they distribute the tools.

And MAPP is no longer for vendors alone: Microsoft is now offering a MAPP program for incident responders as well, where Microsoft will provide them with attack intelligence and an intel-sharing forum to safely share attack particulars, such as malicious URLs, file hashes, and other incident data. CERTs, government entities, and private organizations are the audience here, according to Microsoft. "More incident response companies are spinning up, and CERTs are requiring this information," says Jerry Bryant, senior security strategist for Microsoft's Trustworthy Computing group. "This will facilitate information and response exchange, and start with information we have based on threat indicators ... the biggest goal here is to facilitate the exchange of threat information."

It all boils down to the new reality for organizations today: that attacks from determined threat actors are inevitable, so detection of malware and infiltration are key to recovering and remediating as soon as possible. "This is just the beginning of a lot of changes we're making under MAPP," Bryant says. "Our goal is to move the program from just a protection program to a protection, detection, and remediation program."

Microsoft has been forging closer ties with outside security researchers during the past few years, starting with its Blue Hat Summit, then the Blue Hat Prize in 2011, which awarded researchers with cash and prizes for coming up with defense mitigation methods, and, most recently, its game-changing, three-part bug bounty program launched late last month. The software giant has received 19 submissions for the bug bounty program as of July 17.

[How Microsoft's new bug bounty program will play in the quest for more secure software. See Microsoft's Big Bucks For Bugs Ups The Ante.]

Microsoft also is now offering a free cloud-based MAPP Scanner tool that scans documents, PDFs, and URLs for what it calls "content-based" attacks. The Azure-based cloud service is currently in beta with MAPP vendor and response partners, who submit documents or URLs for scanning, which is processed in a virtual machine. The service is based on an internal tool used by Microsoft to analyze suspicious documents.

"The advantage of the MAPP Scanner is that it focuses on unknown vulnerabilities," Bryant says. "It's based on a tool we use in our content-based investigations. Our intention was to provide it to the response community at no charge."

The scanner service provides "active analysis" to discern whether a file is attempting to exploit a bug, and the goal is to pinpoint new attacks and attack vectors.

"What we're doing with MAPP is part of our overall strategy for protecting customers," Bryant says. "We want to get as many exploits off the street as possible, and then we can work on remediation. The partner programs we have under the MAPP moniker are the vehicle" for this, he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.