Cyber crimes happen everyday, and everyday IT security companies track and record details around these attacks. Microsoft is upping its game and launching a real-time threat feed so that its fellow partners can study existing threats it finds and learn the best steps to proactively take against them.
Microsoft presently has a process set up to take down dangerous botnets. Microsoft “swallows” the botnets and lets them infect accounts that are highly controlled by Microsoft’s team. Once the botnets infect the accounts, Microsoft learns the way they work and eliminates them as a threat.
Microsoft can now collect threat information and share it with ISPs, government agencies, private companies, and CERTs. The impact of such a move by Microsoft could be significant. Analysts point out that while a real-time threat feed won’t lower the amount of attacks, it will help information security specialists react to these threats faster. This might limit the amount of damage brought on by these attacks.
Another great result a real-time threat feed could have is an increase in overall information sharing between IT security companies. For too long IT companies have been hesitant to share threat information for the fear that it could fuel more attacks. Most experts say this an unsupported fear. The cyber criminal “community” has already been sharing and gaining knowledge from each other. It’s only logical therefore that IT security professional share as much information as possible to fight the seemingly endless barrage of new cyber threats.
Let’s hope that security professionals soon understand that sharing information is more valuable than secrecy. And let’s hope that Microsoft’s move is a first step in this change of attitude.
Blog

