Your customers demand and deserve better security and privacy in their software. This book is the first to detail a rigorous, proven methodology that measurably minimizes security bugs—the Security Development Lifecycle (SDL). In this long-awaited book, security experts Michael Howard and Steve Lipner from the Microsoft Security Engineering Team guide you through each stage of the SDL—from education and design to testing and post-release. You get their first-hand insights, best practices, a practical history of the SDL, and lessons to help you implement the SDL in any development organization.
Discover how to:
Use a streamlined risk-analysis process to find security design issues before code is committed
Apply secure-coding best practices and a proven testing process
Conduct a final security review before a product ships
Arm customers with prescriptive guidance to configure and deploy your product more securely
Establish a plan to respond to new security vulnerabilities
Integrate security discipline into agile methods and processes, such as Extreme Programming and Scrum
Includes a CD featuring:
A six-part security class video conducted by the authors and other Microsoft security experts
Sample SDL documents and fuzz testing tool
PLUS—Get book updates on the Web.
A Note Regarding the CD or DVD
The print version of this book ships with a CD or DVD. For those customers purchasing one of the digital formats in which this book is available, we are pleased to offer the CD/DVD content as a free download via O'Reilly Media's Digital Distribution services. To download this content, please visit O'Reilly's web site, search for the title of this book to find its catalog page, and click on the link below the cover image (Examples, Companion Content, or Practice Files). Note that while we provide as much of the media content as we are able via free download, we are sometimes limited by licensing restrictions. Please direct any questions or concerns to booktech@oreilly.com.
The Need for the SDL
Chapter 1 Enough Is Enough: The Threats Have Changed
Worlds of Security and Privacy Collide
Another Factor That Influences Security: Reliability
It’s Really About Quality
Why Major Software Vendors Should Create More Secure Software
Why In-House Software Developers Should Create More Secure Software
Why Small Software Developers Should Create More Secure Software
Summary
References
Chapter 2 Current Software Development Methods Fail to Produce Secure Software
"Given enough eyeballs, all bugs are shallow"
Proprietary Software Development Methods
Agile Development Methods
Common Criteria
Summary
References
Chapter 3 A Short History of the SDL at Microsoft
First Steps
New Threats, New Responses
Windows 2000 and the Secure Windows Initiative
Seeking Scalability: Through Windows XP
Security Pushes and Final Security Reviews
Formalizing the Security Development Lifecycle
A Continuing Challenge
References
Chapter 4 SDL for Management
Commitment for Success
Managing the SDL
Summary
References
The Security Development Lifecycle Process
Chapter 5 Stage 0: Education and Awareness
A Short History of Security Education at Microsoft
Ongoing Education
Types of Training Delivery
Exercises and Labs
Tracking Attendance and Compliance
Measuring Knowledge
Implementing Your Own In-House Training
Key Success Factors and Metrics
Summary
References
Chapter 6 Stage 1: Project Inception
Determine Whether the Application Is Covered by SDL
Assign the Security Advisor
Build the Security Leadership Team
Make Sure the Bug-Tracking Process Includes Security and Privacy Bug Fields
Determine the "Bug Bar"
Summary
References
Chapter 7 Stage 2: Define and Follow Design Best Practices
Common Secure-Design Principles
Attack Surface Analysis and Attack Surface Reduction
Summary
References
Chapter 8 Stage 3: Product Risk Assessment
Security Risk Assessment
Privacy Impact Rating
Pulling It All Together
Summary
References
Chapter 9 Stage 4: Risk Analysis
Threat-Modeling Artifacts
What to Model
Building the Threat Model
The Threat-Modeling Process
Using a Threat Model to Aid Code Review
Using a Threat Model to Aid Testing
Key Success Factors and Metrics
Summary
References
Chapter 10 Stage 5: Creating Security Documents, Tools, and Best Practices for Customers
Why Documentation and Tools?
Creating Prescriptive Security Best Practice Documentation
Creating Tools
Summary
References
Chapter 11 Stage 6: Secure Coding Policies
Use the Latest Compiler and Supporting Tool Versions
Use Defenses Added by the Compiler
Use Source-Code Analysis Tools
Do Not Use Banned Functions
Reduce Potentially Exploitable Coding Constructs or Designs
Use a Secure Coding Checklist
Summary
References
Chapter 12 Stage 7: Secure Testing Policies
Fuzz Testing
Penetration Testing
Run-Time Verification
Reviewing and Updating Threat Models if Needed
Reevaluating the Attack Surface of the Software
Summary
References
Chapter 13 Stage 8: The Security Push
Preparing for the Security Push
Training
Code Reviews
Threat Model Updates
Security Testing
Attack-Surface Scrub
Documentation Scrub
Are We Done Yet?
Summary
References
Chapter 14 Stage 9: The Final Security Review
Product Team Coordination
Threat Models Review
Unfixed Security Bugs Review
Tools-Use Validation
After the Final Security Review Is Completed
Summary
Chapter 15 Stage 10: Security Response Planning
Why Prepare to Respond?
Preparing to Respond
Security Response and the Development Team
Summary
References
Chapter 16 Stage 11: Product Release
References
Chapter 17 Stage 12: Security Response Execution
Following Your Plan
Making It Up as You Go
Knowing What to Skip
Summary
References
SDL Reference Material
Chapter 18 Integrating SDL with Agile Methods
Using SDL Practices with Agile Methods
Augmenting Agile Methods with SDL Practices
Summary
References
Chapter 19 SDL Banned Function Calls
The Banned APIs
Why the "n" Functions Are Banned
Important Caveat
Choosing StrSafe vs. Safe CRT
Using StrSafe
Using Safe CRT
Other Replacements
Tools Support
ROI and Cost Impact
Metrics and Goals
References
Chapter 20 SDL Minimum Cryptographic Standards
High-Level Cryptographic Requirements
Cryptographic Algorithm Usage
Data Storage and Random Number Generation
References
Chapter 21 SDL-Required Tools and Compiler Options
Michael Howard, CISSP, is a leading security expert. He is a senior security program manager at Microsoft and the coauthor of 19 Deadly Sins of Software Security and the award-winning Writing Secure Code. Michael has worked on Microsoft Windows security since 1992 and now focuses on secure design, programming, and testing techniques. He is the consulting editor for the Secure Software Development Series of books by Microsoft Press.
Steve Lipner, CISSP, is the senior director of Security Engineering Strategy for Microsoft. He is responsible for defining and updating the Security Development Lifecycle and has pioneered numerous security techniques. Steve has over 35 years’ experience as a researcher, development manager, and general manager in IT security.
