Pressure mounts for a swifter response to vulnerabilities

“An end may be in sight to vendors dragging their feet when it
comes to releasing patches. After Google announced that it will in
future give software vendors just 60 days to patch security
vulnerabilities before public disclosure, the Zero Day Initiative
(ZDI), part of Hewlett-Packard / TippingPoint, has announced that,
with immediate effect, it will limit the period for developing
security updates to six months. However, the ZDI says that it will
grant extensions to this deadline in special cases.

“Previously ZDI did not implement a time limit, instead allowing
vendors to take as long as they wanted to develop a patch following
notification of a vulnerability and only releasing information once
a patch had been distributed. The result of this policy is in an
eye-watering list of outstanding patches from major vendors…”

Complete Story