Microsoft’s Vulnerability Rating System: The Difference Between Critical and Important

After customers complained that they couldn’t identify the most serious security vulnerabilities, Microsoft has added a fourth category to its vulnerability rating system. But critics feel that the extra tier adds even more complexity to an administrator’s job.

Under the new system, fewer bulletins get the “critical” stamp. Only vulnerabilities that could be exploited to allow malicious Internet worms to spread without user action are now rated critical. Many issues that were previously rated critical are now “important,” a new category in the rating system. These “important” vulnerabilities could still expose user data or threaten system resources, but they might not receive the urgent attention from administrators that they deserve.

“If Microsoft wanted to simplify matters, they should’ve done just thatcut the categories down from three to two levels. Administrators want to know whether a patch needs to be applied immediately, or if they can conveniently schedule it,” says Thor Larholm, a Copenhagen, Denmark-based security researcher with PivX Solutions.

A two-tiered system would let administrators quickly decide whether they need to drop all tasks at hand and apply a patch, or whether the risk is small enough that they can wait and include it in a weekly patch cycle.