Security Update Guide brings growing pains to Patch Tuesday

With Microsoft's April 2017 Patch Tuesday release, the company has officially ditched its familiar security bulletin format in favor of the new Security Update Guide, but there have been some growing pains with the changes.

The biggest change is the switch from bulletin updates, which grouped fixes by product, to the Security Update Guide, which focuses more on the Common Vulnerabilities and Exposures (CVE) being targeted in a specific patch.

Amol Sarwate, director of vulnerability labs at Qualys Inc., said the "new Security Update Guide offers same amount and granularity of information per vulnerability and offers better search capabilities."

"The new setup is geared more toward automation and supports APIs to download information into a structured format," Sarwate told SearchSecurity. "In my opinion, to understand, prioritize and get a holistic view of the monthly updates, organizations now need to create their own scripts or computer programs that perform information crunching."

However, analysts are finding it more difficult to parse the data because of the need to develop new tools while the new Security Update Guide breaks old tools.

Tyler Reguly, manager of Tripwire's vulnerability and exposure research team (VERT), said that the change made it impossible to maintain its alert format.

"When Microsoft launched their security bulletins and introduced the concept of Patch Tuesday, they unknowingly set the gold standard in vendor-customer security communication. Other vendors still struggle to duplicate what Microsoft accomplished years ago," Reguly wrote in a blog post. "The portal, in its current iteration, is not an adequate replacement for security bulletins, but we can hope that Microsoft is taking feedback, listening to security professionals and customers, and working to improve the system to create a solution that far exceeds the previous offering."

Greg Wiseman, senior security researcher at Rapid7, said the Security Update Guide is currently "a bit of a mixed bag, with several improved aspects but also some new pain points," but remained optimistic that the flexibility of the new system is the right way forward.

"The guide lacks a summary listing all the CVEs on a single page, so there's a lot more clicking involved while navigating it. A glitch that will hopefully be fixed soon is the inconsistent way they reference CVEs in the Security Update table, which makes the new search capability less effective," Wiseman told SearchSecurity. "On the other hand, with the new focus on CVEs, Microsoft is providing more detailed information about individual vulnerabilities. The main benefit of the guide for enterprises is the ability to filter and sort by product and severity, which was lacking in the older static bulletin pages. This makes it easier to prioritize critical fixes and ignore products that aren't relevant to the organization."