Katie Moussouris of Microsoft on vulnerability disclosure, ISO standard

Katie Moussouris of Microsoft on vulnerability disclosure, ISO standard

Katie Moussouris of Microsoft on vulnerability disclosure, ISO standard

Date: Mar 26, 2012

Vulnerability disclosure has long been a hot-button security issue, and Katie Moussouris is often on the front lines of the debate for Microsoft in her role as senior security strategist lead for the Microsoft Security Response Center.

Moussouris often works directly with security researchers who find vulnerabilities and bring them to Microsoft’s attention. She’s become a critical figure for Microsoft, not only in outreach and establishing working relationships with white hat and gray hat hackers, but internally helping execute on the Trustworthy Computing initiative with the development of Microsoft’s Exploitability Index and the Microsoft Active Protections Program (MAPP).

In this interview with TechTarget Security Media Group Editorial Director Mike Mimoso, Moussouris talks about her work at Microsoft, the company’s philosophy of coordinated vulnerability disclosure and how it views offensive security research.

They also talk about Microsoft’s vocal support of defensive security research and the BlueHat Prize, to be announced at this year’s Black Hat Briefings. Finally, Moussouris provides an update on the progress being made by the International Standards Organization (ISO) on the development of a vulnerability disclosure standard.

More on Security Testing and Ethical Hacking

  • canderson

    How to make penetration test results matter

    VIDEO - Voodoo Security founder Dave Shackleford details how enterprises can make penetration test results more meaningful than a compliance exercise.
  • canderson

    Trustwave sees emergence of on-demand pen testing services

    VIDEO - Trustwave's Charles Henderson spoke with Editorial Director Robert Richardson about the company's on-demand penetration testing services.
  • canderson

    Zed Attack Proxy tutorial: Uncover Web app vulnerabilities using ZAP

    VIDEO - Video: Keith Barker of CBT Nuggets offers a OWASP Zed Attack Proxy tutorial. Learn how to find and nullify Web application vulnerabilities using ZAP.
  • How often should businesses conduct pen tests?

    Answer - Depending on whom you talk to, pen tests should be done annually or monthly. Expert Kevin Beaver discusses how to find your organization's answer.
  • Sony Pictures hacking back: The ethics of obfuscation

    News - News roundup: Amid a devastating breach incident Sony Pictures is fighting back, raising legal and ethical questions. Plus: A big week in security acquisitions; Comcast sued over open Wi-Fi; and Yahoo announces vulnerability disclosure policy.

    ( Dec 12, 2014 )

  • Encryption everywhere: Debating the risks and rewards

    News - News roundup: As the industry responds to growing demand for end-to-end Internet encryption, some fear unintended consequences. Plus: Black hats wanted; Windows Phone survives Pwn2Own; webcam spying resurgence.

    ( Nov 21, 2014 )

  • Can NIST 800-115 help with penetration testing?

    Answer - Compliance with NIST 800-115 is important for enterprises to maintain while testing systems. Expert Mike Chapple explains the best way to do that.
  • ethical hacker

    Definition - An ethical hacker is a computer and networking expert who systematically attempts to penetrate a computer system or network on behalf of its owners for the purpose of finding security vulnerabilities that a malicious hacker could potentially exploit.

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: