[REVS] Trustworthy Computing Security Development Lifecycle of Microsoft

From: SecuriTeam (support_at_securiteam.com)
Date: 03/24/05

  • Next message: SecuriTeam: "[NEWS] Samsung ADSL Modem Arbitrary File Access, Default Root Password and Root File System Access" 
    To: list@securiteam.com
Date: 24 Mar 2005 19:06:05 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Trustworthy Computing Security Development Lifecycle of Microsoft
    ------------------------------------------------------------------------

    SUMMARY

    This paper describes the SDL ( Security Development Lifecycle) and
    discusses experience with its implementation across Microsoft software.

    DETAILS

    The SDL is the process that Microsoft has implemented for the development
    of software that needs to withstand malicious attack.

    The process encompasses the addition of a series of security-focused
    activities and deliverables to each of the phases of Microsoft's software
    development process. These activities and deliverables include the
    development of threat models during software design, the use of static
    analysis code-scanning tools during implementation, and the conduct of
    code reviews and security testing during a focused "security push".

    Before software developed under the SDL can be released, it must undergo a
    Final Security Review by a team independent from its development group.
    When compared to software that has not been subject to the SDL, software
    that has undergone the SDL has experienced a significantly reduced rate of
    external discovery of security vulnerabilities.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mikehow@microsoft.com>
    Michael Howard.
    The original article located at: <http://msdn.microsoft.com/security/sdl>
    http://msdn.microsoft.com/security/sdl

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Samsung ADSL Modem Arbitrary File Access, Default Root Password and Root File System Access"

    Relevant Pages