Experts Are Saying That The Bug-Exploit Ratings Of Microsoft Are Useless

8th November 2009

The monthly predictions of Microsoft Corporation about whether the hackers will be creating any reliable exploit code for the bugs was only right about one quarter of the time during the first half of the year 2009 as the company acknowledged this on Monday. Andrew Storms, the director of the security operations at nCircle Network Security has said that it is not as good as a coin toss, so what is the point in it?

During October 2008, Microsoft Corp. had added the exploitability index with the security bulletins that it issues every month. This index has rated the bugs on a scale of 1 to 3, with a 1 which indicates that the consistently successful exploit code would be likely during the coming 30 days, and a 3 means that the working exploit code was not likely during the same period.

Its idea was actually to give its customers more of the information in order to decide which of the vulnerabilities should be patched first and before the introduction of this index, Microsoft had only offered the impact ratings like critical, important, moderate and low, and that too as an aid for its users who were puzzled by which flaws should first be fixed immediately and which ones could be set on one side for the moment.