The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Trustworthy Computing Security Development Lifecycle of Microsoft
------------------------------------------------------------------------
SUMMARY
This paper describes the SDL ( Security Development Lifecycle) and
discusses experience with its implementation across Microsoft software.
DETAILS
The SDL is the process that Microsoft has implemented for the development
of software that needs to withstand malicious attack.
The process encompasses the addition of a series of security-focused
activities and deliverables to each of the phases of Microsoft's software
development process. These activities and deliverables include the
development of threat models during software design, the use of static
analysis code-scanning tools during implementation, and the conduct of
code reviews and security testing during a focused "security push".
Before software developed under the SDL can be released, it must undergo a
Final Security Review by a team independent from its development group.
When compared to software that has not been subject to the SDL, software
that has undergone the SDL has experienced a significantly reduced rate of
external discovery of security vulnerabilities.
ADDITIONAL INFORMATION
The information has been provided by <mailto:mikehow@microsoft.com>
Michael Howard.
The original article located at: <http://msdn.microsoft.com/security/sdl>
http://msdn.microsoft.com/security/sdl
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
