Industry group to stamp on bugs

Software makers including Microsoft are to set up test guidelines for reporting software flaws that affect internet security.

The Organisation for Internet Safety will establish unified procedures and policies for software companies to announce product flaws.

The group springs from discussions between Microsoft and a handful of security companies on the reporting of software bugs that affect corporate systems.

Membership of the group is secret, but vnunet.com understands that Microsoft and security companies Foundstone, @Stake, Guardent, BindView and Internet Security Systems are among those involved.

Delaying the disclosure of vulnerabilities, and urging legitimate researchers to allow software makers time to fix software problems before they're made public, could play a large role in limiting the effect of newly discovered vulnerabilities in Microsoft products.

The group is expected to announce its final structure and name within two months.