Owasp Sdl-It PDF

Microsoft Security Development
Lifecycle for IT
Rob Labbé
Application Consulting and Engineering Services
roblab@microsoft.com
The Reasons for Secure Software
There are • Data can be stolen by attackers
many • Data can be corrupted by viruses

• Data can be lost or corrupted by
threats to
employees
• IT Systems can be used by attackers
data and • To send Spam, viruses, or launch

other attacks from
systems • IT Systems can be crashed by attackers

Application Layer = Weak Point
• Attackers target the weakest point. The OS
Layer and Network layer are too hard now
• On Average over 70% of IT security budget is
spent on Infrastructure, yet over 75% of attacks
happen at the Application level
• According to Microsoft research, only 1/3 of
developers are confident that they write secure
code
• The focus must be on hardening the
application layer
Reasons for IT Security
• Card Services - A Real World Example
• $10 Million a month in revenue
• Processed credit cards for American Express, Master
Card, and VISA
• They Lost 40 Million records to hacking
• Government imposed heavy fines
• Subject to audits every 6 months for 20 years
• Amex, Master Card and Visa dropped them
• A $10 Million a month company destroyed
Hackers are very smart
We need better security
Implement an SDL
• Implement an SDL to build security into
your development process
• Train your developers in secure coding
techniques
• Incorporate Threat Modeling, Secure Code
Review, Security Focused Testing into the
process
Purpose of the SDL
• Inventory and assess applications
• Identify and ensure resolution of
security/privacy vulnerabilities found in those
applications
• Enable Application Risk Management:
• Strategic
• Tactical
• Operational
• Legal
The SDL is NOT Optional
• At Microsoft all line-of-business
application teams must go through SDL-IT,
All shrink-wrapped products must go
through the SDL
• If they fail to do so, they cannot go into
production
• Enforcement of the SDL-IT process
attributes to it’s success
Visibly Measure the Process
• Have internally visible score cards
• Have contests to see if you can find bugs
and offer prizes
• Offer incentives to teams with the best
security records (no cheating!)
SDL aligns with SDLC
Envision Design Develop / Test Release /

SDLC Purchase Sustainment
Threat
Application Model / Post-
Internal Pre-Production Production
SDL-IT Entry / Risk Design
Review Assessment
Assessment Review Assessment
Application Entry / Risk Assessment
Post-Production
App Entry Internal Review
Assessment
Threat Model / Pre-Production

Design Review Assessment
• Objective:
• Application Inventory
• Determine Application Risk Categorization
• High Risk Security/Privacy Release
• Medium Risk Security/Privacy Release
• Low Risk Security/Privacy Release
Threat Model / Design Review
Post-Production
Assessment

• Objective:
• Threat modeling provides a consistent methodology for objectively evaluating threats to
applications.
• Review application design to verify compliance with security standards and best practices
• Verify application meets application principles
• Confidentiality
• Integrity
• Authentication
• Authorization
• Availability
• Non-repudiation
Internal Review
Post-Production
App Entry Internal Review Assessment

• Review security checklist/policy site

• Team conducts ‘self’ code review and attack and
penetration testing
Pre-Production Assessment
Post-Production
Assessment

• Objective:
• Low Risk Applications
• Host Level Scan
• Windows
• IIS
• SQL
• High/Medium Risk Applications
• Host Level Scan
• White Box Code Review
White Box Code Review
• Process
• Application team provides source code
• Analysts review application code
uncovering security vulnerabilities
• Vulnerabilities logged in bug database
• Application team required to address all
sev 1 bugs prior to going into
production
Some common attack patterns
white box review may reveal
• Cross-Site Script Vulnerabilities
• SQL Injection
• Buffer Overflow
• Poor Authorization Controls
• Secrets Stored In Clear Text
Post-Production Assessment
Post-Production
App Entry Internal Review Assessment

• Objective:
• High/Medium/Low Risk Applications
• Host Level Scan
• Windows
• IIS
• SQL
Conclusion
• The need for security is obvious, we have to
protect the company and our customers
• To do that we need
• Management Support
• Secure Development Life Cycles
• Developers trained in secure development
• A Security First attitude!
Conclusions
• Continuous improvement of the process
• Invest time in upfront activities:
• Threat Modeling People: Providing guidance on
secure application development
• Design Reviews
• A holistic view
• People
• Process Process: Security
• Tools
cannot be an Tools: Providing the
afterthought most innovative tools
• It may seem hard to get started – ask for help!

Call To Action
• Implement a Secure Development Lifecycle
• Create more secure and reliable software
• Build Trust!
Resources
• ACE Team Blog:
• http://blogs.msdn.com/ace_team/default.aspx
• Threat Modeling Tool
• http://go.microsoft.com/fwlink?linkid=77002
• Threat Modeling Blog:
• http://blogs.msdn.com/threatmodeling/
• Rob Labbé’s Blog:
• http://blogs.msdn.com/roblabbe/default.aspx
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be re gistered
trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this
presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part
of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Owasp Sdl-It PDF

Uploaded by

Copyright:

Available Formats

Owasp Sdl-It PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Owasp Sdl-It PDF

Uploaded by

Copyright:

Available Formats

Microsoft Security Development

There are • Data can be stolen by attackers

many • Data can be corrupted by viruses

data and • To send Spam, viruses, or launch

systems • IT Systems can be crashed by attackers

Envision Design Develop / Test Release /

Threat Model / Pre-Production

Threat Model / Pre-Production

Threat Model / Pre-Production

• Review security checklist/policy site

Threat Model / Pre-Production

Threat Model / Pre-Production

• It may seem hard to get started – ask for help!

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.