I finally have in my sweaty little paws a copy of “Threat Modeling” from MSPress, written by Swiderski and Snyder. It's a great read, you'll learn a ton. And at 255pp, you'll read it in one sitting :) In my opinion, it's probably one of...

The Sasser worm took advantage of a defect in logging code within the Local Security Authority Subsystem (LSASS.) The entry point for this functionality is through an RPC interface, which is open by default for all users to access on Windows 2000 and...

Did you ever want to know which ports are used by the Cluster Service or Exchange? Well, there's a list available entitled, “Network Ports Used by Key Microsoft Server Products” at http://www.microsoft.com/smallbusiness/gtm/securityguidance...

Build 2149 is RC2 http://www.microsoft.com/technet/prodtechnol/winxppro/sp2preview.mspx

I have to admit, I don't do much ASP.NET work, I mainly write Win32 apps in C++ and C#, but when I do use ASP.NET I invariably have to use the debugger. Mainly because I use the technology so infrequently. So here is the problem - I'm not an admin! When...

I have been a big supporter of threat modeling since a bunch of us started defining and using the process within Microsoft. It's a very useful way to determine how bad guys will attempt to compromise a piece of software, and define appropriate mitigations...

From the “Well-waddya-know Dept.” I just found out this morning there's an RSS feed for Microsoft Security bulletins. You learn something every day! Point your reader at http://www.microsoft.com/technet/security/bulletin/secrss.aspx...

Big thanks to Peter Gutmann and Morten Andersen for their comments.I have highlighted what's new in RED . Errata for Writing Secure Code 2 nd Edition By Michael Howard and David LeBlanc Last Updated 2-Jun-2004 Entire Book Please replace...

If you are getting a user breakpoint when generating a threat model report or using the threat model preview for a threat model with Visio diagrams and you have Visio installed, it may be because stdole’s primary interop assembly (PIA) wasn’t...

Finally, it has been posted - Frank Swiderski's Threat modeling tool is now available for free download on MSDN. From the blurb: The Threat Modeling Tool allows users to create threat model documents for applications. It organizes relevant data...