FYI…
Microsoft advanced notification service changes <<<
- https://isc.sans.edu/diary.html?storyid=19167
2015-01-09 - "… Microsoft is changing the way in which they provide information… You can read the full blog here:
>> http://blogs.technet.com/b/msrc/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx
In a nutshell if you want to be advised in advance you now need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your technical contact can provide information. The main point for me is this one:
'Moving forward, we will provide ANS information directly to Premier customers and current organizations involved in our security programs, and will no longer make this information broadly available through a blog post and web page.'
Now a lot of us do look at that information to plan their next patching cycle. So you will need to look at that process and see what needs changing. You'll have to rely on the information in your patching solution, or register. You can register here:
> http://mybulletins.technet.microsoft.com/
The dashboard that is created in the end looks nice, but for me too early to tell how useful it is at this stage, although it was slightly painful to review each bulletin. It will take a few patch cycles to sort it all out I'd say.
Screenshot: https://isc.sans.edu/diaryimages/images/Screen%20Shot%202015-01-09%20at%2018_34_43.png
So going forward you will need to adjust how you identify the patches to be applied within your environment. If you do not want to register you can just visit the main bulletins page here:
–> https://technet.microsoft.com/en-us/library/security/dn631937.aspx
This page has a list of all released bulletins."
___
myBulletins Q&A: http://technet.microsoft.com/en-us/security/dn722424
___
- https://technet.microsoft.com/en-us/security/bulletin
Next release: January 13, 2015
> http://www.microsoft.com/en-us/download/details.aspx?id=36982
Note: There are multiple files available for this download.Once you click on the "Download" button, you will be prompted to select the files you need.
Version: 1.0
File Name: BulletinSearch.xlsx - File Size: 1.9 MB
MSRC-CVRF.zip - 881 KB
Date Published: 1/5/2015
This download offers the following items:
1. Excel file that contains affected software, bulletin replacement, reboot requirements, and CVE information from the Microsoft security bulletins (since June 1998)
2. Zip file that contains security bulletins in the Common Vulnerability Reporting Framework (CVRF) format (since June 2012)
> http://www.microsoft.com/en-us/download/confirmation.aspx?id=36982
___
- http://www.theinquirer.net/inquirer/news/2389603/microsoft-kills-off-patch-tuesday-advance-notifications-with-no-advance-notification
Jan 9 2015 - "… This is the -second- time that Microsoft has attempted to kill off the ANS. In July 2014, the company was forced to backpedal after announcing the end of ANS by email with almost no advance notification before giving the following advance notification a few days later: "We have reviewed our processes and will resume these security notifications with our monthly Advanced Notification Service on July 3 2014." Whether or not the ANS will be brought back from the boneyard a second time remains to be seen, but it may come down to feedback, especially given the -lack- of advance notification that it was to close. The previous move was due to regulations on email distribution being tightened, but this time it appears that the death knell of the ANS is more extensive. We know that many of our readers have taken a -keen- interest in the Advance Notification articles that we have written every month, and so we are as surprised as you are that there will no longer be any advance notification. But take this as advance notification that our coverage and analysis of Patch Tuesday will continue in 2015. Albeit -without- advance notification."
- http://www.infoworld.com/article/2865301/security/the-inanity-of-paying-for-microsoft-advanced-security-notifications.html
Jan 9 2015 - "For those of us who watch every month for advance warning of Microsoft security patches - they appear on the Thursday preceding Black Tuesday, every month - yesterday came as a slap in the face. Without any warning, Microsoft abruptly stopped its free Advance Notification Service on the day we were all expecting the usual advanced warnings for the January 2015 Black Tuesday patches… Translation: If you want advanced notice of upcoming security bulletins, you have to become a 'Premier customer'… In the past year, Microsoft patching has reached breathtaking new lows, both in quantity -and- quality of patches delivered. The situation's deteriorated so much that many graybeards are beginning to wonder if Windows is so unwieldy that it's become unusable. Somehow, I don't think the powers-that-be understand the way decisions like this affect the Windows support community. I can't fathom why Microsoft would so aggressively piss-off the people who are trying to keep Windows working, over such a tiny concession."
