Just a week before the January Microsoft Patch Tuesday, Microsoft announced the end of their Advanced Security Notifications (ANS) for the general public. Administrators have been using this service for many years to prepare for their patching policy. The ANS was released the Thursday before the upcoming Patch Tuesday to inform their customers of basic information on the security patch releases. This information contained affected products, severity and the attack vector of the vulnerabilities.
Although the ANS is not available to the general public, Microsoft will continue to supply the service to companies that are a part of the Microsoft Active Protections Program (MAPP). This community is comprised of organizations that have partnered with Microsoft. These organizations already receive even more detailed information about vulnerabilities and patches, and they are not your small or medium-sized organizations.
Some (including Microsoft ) believe that many organizations do not use the advanced notification service, and so there is no need for Microsoft to continue to provide the service:
"(…) customer feedback indicates that many of our large customers no longer use ANS in the same way they did in the past due to optimized testing and deployment methodologies. While some customers still rely on ANS, the vast majority wait for Update Tuesday, or take no action, allowing updates to occur automatically. More and more customers today are seeking to cut through the clutter and obtain security information tailored to their organizations," said Chris Betz, Senior Director of Microsoft's Security Response Center in a blog post, explaining the decision
Several members of the security community believe this service is critical for organizations to plan out their patching policies and practices, and accuse Microsoft of being more concerned with revenue than security.
This week, as we are just coming up to our second Microsoft Patch Tuesday without an advanced notification, I would like to know how this new policy actually affects you?
Does it impede your mitigation and patching efforts window for your network, or are you not seeing any adverse effects of the sudden change?
Leave you comment here.