Threat Level: green Handler on Duty: Russ McRee

SANS ISC: No more Microsoft advisory email notifications? SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
No more Microsoft advisory email notifications?

We had this sent to us today letting us know there will no longer be emails sent by Microsoft for advanced notifications, etc.  Instead people are to use the RSS feeds or other mechanisms.  

********************************************************************
Title: Microsoft Security Notifications
Issued: June 27, 2014
********************************************************************

Notice to IT professionals:

As of July 1, 2014, due to changing governmental policies concerning the issuance of automated electronic messaging, Microsoft is suspending the use of email notifications that announce the following:

* Security bulletin advance notifications
* Security bulletin summaries
* New security advisories and bulletins
* Major and minor revisions to security advisories and bulletins

In lieu of email notifications, you can subscribe to one or more of the RSS feeds described on the Security TechCenter website. 

For more information, or to sign up for an RSS feed, visit the Microsoft Technical Security Notifications webpage at http://technet.microsoft.com/security/dd252948

Not quite sure what legislation changes they might be referring to (haven't seen anything yet). Either way if like me you used to receive these emails, you may no longer and you'll have to subscribe to the RSS feed.  

I couldn't find anything on the Microsoft website (let me know if you can), but when following the links for "sign up for email notification" every page visited only has an RSS or web option, no email.  

Cheers

Mark H  - Shearwater

 Mark

391 Posts
ISC Handler
Jun 28th 2014
Thread locked Subscribe Jun 28th 2014
6 years ago
Hm, the only legislation I can think of going into effect July 1st is the Canadian spam act: http://fightspam.gc.ca/ which basically requires mandatory consent of all recipients…
 Tony

1 Posts
Quote Jun 28th 2014
6 years ago
There's a new anti-spam law going into effect on July 1 in Canada. See http://www.zdnet.com/microsoft-to-suspend-certain-email-security-notifications-7000031017/ for my story on it
 Larry Seltzer

25 Posts
Quote Jun 28th 2014
6 years ago
Yea that's what we were discussing as well. However recipient of the message was not in Canada also I would have thought that signing up for a notification service would count as consent.
 Mark

391 Posts
ISC Handler
Quote Jun 28th 2014
6 years ago
The (indirect) word I have is that it is indeed an (over)reaction to the Canadian law. What I don't understand is why they couldn't simply say "We're resetting the distribution list, everybody has to opt in again". Or create a Twitter feed specific to security bulletins instead of a news aggregation protocol that seems to be falling out of favor. All around odd...
 Anonymous
Quote Jun 28th 2014
6 years ago
Quoting Mark:However recipient of the message was not in Canada

One reason why many people are excited about the CASL is that it will likely be impossible for senders to distinguish between recipients in the US and those in Canada. So they will have to make sure their emails comply to CASL even for their US recipients.
 Martijn

5 Posts
Quote Jun 28th 2014
6 years ago
One note for those dinosaurs out there like me. I finally got around to figuring out how to solve my issues with RSS (I don't want to have to remember to use an RSS reader, and since I still use mutt as a mail reader, I don't really have RSS support). My solution is that I finally discovered rss2email.
 Martijn
4 Posts
Quote Jun 28th 2014
6 years ago
Quoting Anonymous:What I don't understand is why they couldn't simply say "We're resetting the distribution list, everybody has to opt in again"..


Really?! When was the last time you had the option to "OPT IN"?!
 ICI2Eye

52 Posts
Quote Jun 28th 2014
6 years ago
This might have more to do with Bogus security bulletin emails purporting to be from Microsoft, but actually containing links to Malware infected sites or payloads.

Either way the RSS feeds of interest can be found here:

http://technet.microsoft.com/en-US/security/dd252948

https://technet.microsoft.com/en-us/security/rss/bulletin
https://technet.microsoft.com/en-us/security/rss/comprehensive
https://technet.microsoft.com/en-us/security/rss/advisory
http://blogs.technet.com/b/msrc/rss.aspx
 Eddie

1 Posts
Quote Jun 30th 2014
6 years ago
And now...Microsoft is apprarently reversing course and will reinstate the email notifications:
http://krebsonsecurity.com/2014/06/microsoft-kills-security-emails-blames-canada/

"In an apparent reversal of its decision, Microsoft now says it will be re-starting its security notifications via email early next month. From a Microsoft’s spokesperson: “On June 27, 2014, Microsoft notified customers that we were suspending Microsoft Security Notifications due to changing governmental policies concerning the issuance of automated electronic messaging. We have reviewed our processes and will resume these security notifications with our monthly Advanced Notification Service (ANS) on July 3, 2014.”"
 T

31 Posts
Quote Jul 1st 2014
6 years ago

Sign Up for Free or Log In to start participating in the conversation!