Jeff Jones Security Blog

Browse by Tags

Microsoft Security Essentials Beta Full in One Day

After launching yesterday , the Beta for Microsoft Security Essentials has filled up – see the screenshot below. This first Beta was limited to 75,000 participants within some targeted geographies and it is encouraging to see this target achieved Read More...

Posted Thursday, June 25, 2009 1:32 AM by jrjones | 0 Comments

Filed under: Microsoft, Antivirus, Microsoft Security Essentials, Antimalware

Microsoft Free Anti-Malware (Morro/Microsoft Security Essentials) Released as Beta

Though I have not been directly involved with Morro (or any other anti-malware products), I am excited to see Morro ( Microsoft Security Essentials , http://www.microsoft.com/security_essentials/ ) reach the next stage of development by releasing as a Read More...

Posted Tuesday, June 23, 2009 10:06 PM by jrjones | 1 Comments

Filed under: Security, Microsoft, Antivirus, Microsoft Security Essentials, Antimalware, Morro

Security Intelligence Report v6

This morning, we released the latest version of the Microsoft Security Intelligence Report (SIRv6), examining industry-wide software vulnerability disclosures, Microsoft vulnerability disclosures and exploits, malicious software (malware), and potentially Read More...

Posted Wednesday, April 08, 2009 8:37 PM by jrjones | 1 Comments

Filed under: Microsoft, Vulnerabilities, SecurityGuy, Security Intelligence Report

Firefox in 2008 – No Single Version Available for The Full Year?

I’ve been busy doing analysis for the next article in my cio.com Firefox series of articles, looking at vulnerability disclosures during 2007 and 2008 and I stumbled upon a little factoid that I had not previously noticed – no single version of Firefox Read More...

Posted Thursday, February 26, 2009 11:58 PM by jrjones | 7 Comments

Filed under: Security, Open Source, IE, Microsoft, Firefox, Browser Security, Mozilla, Lifecycle

Feb09 Security Bulletin SDL Benefit Summary

Summaries from previous months: Jan09 Security Bulletin SDL Benefit Summary When I do analysis and reports on Microsoft products, I typically look for where the Security Development Lifecycle (SDL) has helped to provide improvement and provide some stats Read More...

Posted Wednesday, February 11, 2009 12:24 PM by jrjones | 2 Comments

Filed under: Security, Studies, Windows, Vista, Microsoft, Windows Server, Windows XP SP2, Security Bulletins, SDL, Windows Server Core

Perception: Case in Point

I love it when a good, real-life example falls right into your lap. As you know from my recent posts, I’ve been doing a series of articles probing Mozilla and Firefox security claims. I think I’ve been pretty open about why, but I always seem to Read More...

Posted Thursday, February 05, 2009 8:38 PM by jrjones | 3 Comments

Filed under: Security, Open Source, IE, Microsoft, Firefox, Commentary, Vulns, Vulnerabilities, Bloggers, Browser Security, Mozilla, Perception

CIO.COM: Mozilla and “Counting Still Easy…”

[DISCLOSURE for those who don’t read about boxes: I work for Microsoft.] I admit that I enjoy discussing issues and digging into claims to see if I can find fractures or flaws in logic. When I ran product management teams for companies in previous roles, Read More...

Posted Thursday, February 05, 2009 7:03 PM by jrjones | 1 Comments

Filed under: Security, Studies, Open Source, IE, Microsoft, Firefox, Commentary, Vulns, Vulnerabilities, Browser Security, Mozilla

Brian Krebs Blog on ‘at Risk’ Chart Methodology

I am a couple of articles into my series: Can Mozilla Support Claims of Firefox Being the Most Secure Web Browser? , and Can Mozilla Support Claims of Firefox Being the Most Secure Web Browser? (Part 2) In part 2, I probed Mozilla’s usage of an ‘at risk’ Read More...

Posted Friday, January 30, 2009 6:57 PM by jrjones | 1 Comments

Filed under: Security, Studies, Open Source, IE, Microsoft, Firefox, Vulns, NVD, Vulnerabilities, Process, Browser Security, Mozilla, Brian Krebs

Security Intelligence Report v5

This morning, we released the latest version of the Microsoft Security Intelligence Report (SIRv5), examining industry-wide software vulnerability disclosures, Microsoft vulnerability disclosures and exploits, malicious software (malware), and potentially Read More...

Posted Monday, November 03, 2008 11:29 PM by jrjones | 1 Comments

Filed under: Security, Studies, Microsoft, Security Intelligence Report

Download: H1 2008 Desktop OS Vendor Report - Vulnerabilities and Days-of-Risk

This report looks at all of the vulnerabilities fixed by Apple, Microsoft, Red Hat and Ubuntu during the first half of 2008. At the vendor level, the report examines all vulnerabilities as well as Days of Risk (DoR) associated with those vulnerabilities. Read More...

Posted Monday, October 27, 2008 8:00 AM by jrjones | 10 Comments

Filed under: Security, Studies, Windows vs Linux, Windows, Vista, Open Source, Red Hat, Microsoft, Ubuntu, Mac OS X, Apple, Vulns, NVD, Vulnerabilities, Windows XP SP2, Security Bulletins, SDL

Attachment(s): 1H08-desktop-vuln-report.pdf

Black Hat : Got2 Luv the H8ers

So, this afternoon, I'm in the Microsoft booth at Black Hat when this guy comes up (badge hidden of course) and starts talking to some of my colleagues. Right away, it was pretty obvious that he was antagonistic. I will refer to him as "h8er" from here Read More...

Posted Thursday, August 07, 2008 6:07 AM by jrjones | 24 Comments

Filed under: Security, Vista, Microsoft, Mac OS X, Geek, Black Hat, Story

Exploitability Index - More Information for Customers

Yesterday at Black Hat 2008, along with some other stuff , we announced that we will be adding some new information to Security Bulletins - an "Exploitability Index" for each of the vulnerabilities addressed by the bulletin. Based upon talking with Microsoft Read More...

Posted Wednesday, August 06, 2008 5:20 PM by jrjones | 1 Comments

Filed under: Security, Microsoft, Commentary, Black Hat, Vulnerabilities, Security Bulletins, Exploitability Index, MSRC, SecurityGuy

Black Hat 2008, Here I Come...

Tomorrow, I set off for Black Hat 2008 in Las Vegas to join colleagues that are already there (see Defend the Flag: Roguery Abounds! , over on the new MSRC Ecostrat blog .) As always, I am excited to head over to this conference to see if anything new Read More...

Posted Monday, August 04, 2008 10:29 PM by jrjones | 3 Comments

Filed under: Security, Microsoft, Black Hat

Download Hyper-V RTM for WIndows server 2008

I converted my office fileserver to Windows Server 2008 (WS2008) a while back and I've never been happier - WS2008 is my favorite product ever. Nicely modular, pretty much everything turned off by default and some great tools for enabling just the components Read More...

Posted Friday, June 27, 2008 1:02 AM by jrjones | 1 Comments

Filed under: Windows, Microsoft, Windows Server, Hyper-V, Virtualization

New Security Tools for IIS and SQL

In cast you didn't see it, the Microsoft Security Response Center (MSRC) team just announced the release of three tools to help customers fend off SQL injection attacks: UrlScan 3.0 Beta ( see Wade Hilmo's blog for more ), a security tool that restricts Read More...

Posted Wednesday, June 25, 2008 10:45 PM by jrjones | 4 Comments

Filed under: Security, SQL Server, Microsoft, Database, Developer, Process, SDL, URLScan, IIS, Scrawlr, MSCASI, Tools, SQL Injection