Adobe To Have Its Own 'Patch Tuesday'

What do Adobe and Microsoft have in common? Among other things, they will both have their own regularly scheduled Patch Tuesday for security updates.

Brad Arkin, Adobe director of product security and privacy, said in a company blog post that Adobe would release security updates for all major supported versions and platforms of Adobe Reader and Acrobat on a quarterly basis starting this summer.

Arkin said that the quarterly patches would be released on the second Tuesday of the month each quarter -- made available on the same day Microsoft releases its "Patch Tuesday" security updates. The update release day was intended to accommodate Windows customers who have resources and processes geared toward Microsoft's Patch Tuesday.

Adobe's last two security updates, delivered in March and May, also fell on Microsoft's Patch Tuesday, although Arkin said that the timing of the updates was purely coincidental.

"Although our 3/10/09 and 5/12/09 security patches landed on Patch Tuesday, the timing was coincidental. In both cases, we shipped the patches as soon as we finished testing them," Arkin said.

The newly scheduled Patch Tuesday update release comes as part of a ramped-up effort intended to harden systems and improve vulnerability response times.

Altogether, Adobe says it plans comprehensive code hardening after it launches an initiative to strengthen inherently known at-risk areas of the legacy code, which it will apply to its Secure Product Lifecycle procedures. In the same vein as Microsoft's Security Development Lifecycle, Adobe SPLC integrates security activities such as threat modeling, automated and manual security code reviews, and fuzzing into the standard procedure followed for all products.

Adobe also said it was strengthening input validation on a "best practice" basis, even where no previously known vulnerabilities had existed.

In addition, Adobe pledges a speedier incident response time going forward. The company said that the new process was made more efficient during its last security update for Windows, Mac and Unix platforms issued May 12, which was deployed only two weeks after vulnerabilities were made public.

"Security is an ongoing process, so while we believe our plan will eliminate or mitigate many potential security risks, we are also working to enhance our ability to respond to externally found vulnerabilities in Adobe Reader and Acrobat in the future," Arkin said, adding that in developing its new approach to security, the company has learned lessons from friends and partners.

SHARE THIS ARTICLE