[REVS] Trustworthy Computing Security Development Lifecycle of Microsoft
From: SecuriTeam (support_at_securiteam.com)
Date: 03/24/05
- Previous message: SecuriTeam: "[NEWS] Mozilla Platform's Code Execution Vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: list@securiteam.com Date: 24 Mar 2005 19:06:05 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Trustworthy Computing Security Development Lifecycle of Microsoft
------------------------------------------------------------------------
SUMMARY
This paper describes the SDL ( Security Development Lifecycle) and
discusses experience with its implementation across Microsoft software.
DETAILS
The SDL is the process that Microsoft has implemented for the development
of software that needs to withstand malicious attack.
The process encompasses the addition of a series of security-focused
activities and deliverables to each of the phases of Microsoft's software
development process. These activities and deliverables include the
development of threat models during software design, the use of static
analysis code-scanning tools during implementation, and the conduct of
code reviews and security testing during a focused "security push".
Before software developed under the SDL can be released, it must undergo a
Final Security Review by a team independent from its development group.
When compared to software that has not been subject to the SDL, software
that has undergone the SDL has experienced a significantly reduced rate of
external discovery of security vulnerabilities.
ADDITIONAL INFORMATION
The information has been provided by <mailto:mikehow@microsoft.com>
Michael Howard.
The original article located at: <http://msdn.microsoft.com/security/sdl>
http://msdn.microsoft.com/security/sdl
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: SecuriTeam: "[NEWS] Mozilla Platform's Code Execution Vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
- Security Development Lifecycle Whitepaper Available
... Microsoft has made publicly available our Security Development Lifecycle ...
The SDL is the process that Microsoft has implemented for the ... undergo a Final
Security Review by a team independent from its ... (NT-Bugtraq) - Security Development Lifecycle Whitepaper Available
... Microsoft has made publicly available our Security Development Lifecycle ...
The SDL is the process that Microsoft has implemented for the ... undergo a Final
Security Review by a team independent from its ... (Bugtraq) - Re: Attention Windows Users
... The Trustworthy Computing Security Development Lifecycle ... Security Engineering
and Communications ... Development Lifecycle (or SDL), a process that Microsoft
has ... (rec.aviation.piloting) - [UNIX] Daydream BBS Format String Vulnerability
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... product allows attackers to exploit
a format string vulnerability in the ... This bulletin is sent to members of the
SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
(Securiteam) - [NEWS] L-Forum SQL Injection Vulnerability
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... arbitrary SQL commands
by injecting them through user provided data. ... This bulletin is sent to members of the
SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
(Securiteam)