Microsoft is broadening its Security Development Lifecycle (SDL) program this week, introducing a new template to help IT organizations and coders enable secure software development, and a new category that identifies tool vendors that support SDL processes.
Last year's SDL process template focused on waterfall and spiral development methodologies used internally at Microsoft for development on Office, Word and Windows -- projects that typically take years to complete, said David Ladd, principal security program manager for Microsoft.
"The trend over the long haul is pointing toward more rapid application development and Agile development," Ladd said. "In some cases, you may have a Web component where it doesn't make sense to use processes suited for rapid application development, waterfall or spiral."
Specifically, the template addresses projects such as Web applications and Web-based services that have ongoing maintenance and development efforts, said David Ladd of the Microsoft SDL program. When a new iteration is added to a project, the template helps create security tasks within the SDL.
Visit Microsoft Security Development Lifecycle (SDL).
In addition, the Agile template enables the SDL to check Visual Studio projects and website coding within the Agile source control repository. The template will also give the SDL the ability to create new requirements for ongoing projects.
The tool is available in beta, and Ladd said Microsoft would accept feedback and make changes to the process until the full release, which is expected by the end of the second quarter.
Microsoft introduced the SDL into its internal software development processes in 2004 to reduce the number and severity of vulnerabilities in its software. The SDL focuses on continual training, process improvement and accountability to help development processes react to the constantly changing threat landscape.
A new SDL white paper, released today, simplifies the SDL process. Ladd said the SDL can be implemented by single freelance developers up to large IT organizations, but in the past, smaller IT teams were overwhelmed by the extensive SDL documentation and believed it was too difficult to implement. The new 17-page document simplifies the SDL, he said.
The SDL is an outgrowth of the software giant's Trustworthy Computing program, developed internally more than eight years ago. Since then, Microsoft has gradually released its internal work to the industry at large.
In 2008, Microsoft released a key set of guidelines, called the SDL Optimization Model, which helps IT organizations implement the SDL. A Threat Modeling Tool allows software developers and architects to analyze their projects from a security point of view and identify potential attack vectors and other security issues during the development process.
New SDL Pro Network category
Microsoft has also extended its SDL Pro Network, announcing a new "tool" category of membership within its SDL approved vendors. Pro Network members have a broad understanding of Microsoft's secure development processes and conduct training and help companies implement best practices.
The "tool" category will help companies applying the SDL to choose SDL Pro Network member vendors with static analysis tools, fuzzers or dynamic and binary analysis tools. Fortify Software Inc., Veracode Inc. and Codenomicon Ltd. are the first tool vendors listed in the category. The new Pro Network category also lists several consulting and training firms.
Microsoft development tools are not needed to implement the SDL, Ladd said.
"If you use a security tool and it works well in your environment then keep on using it," Ladd said. "The SDL is not a rip-and-replace framework by any stretch of the imagination."