Are you a startup?
Get BizSpark cloud access
Get up to $3,700 of cloud benefits
Don’t have MSDN?
Here’s cloud access
Microsoft has released Attack Surface Analyzer. It is a Software Development Lifecycle verification tool for developers and IT professionals to identify whether newly developed or installed applications inadvertently change the attack surface of a Microsoft operating system.
Attack Surface Analyzer is the same tool used by Microsoft's internal product teams to catalogue changes made to the operating system by the installation of new software.
Attack Surface Analyzer takes a snapshot of your system state before and after the installation of product(s) and displays the changes to a number of key elements of the Windows attack surface.
The free tool is downloadable from Attack Surface Analyzer – Beta Download.
Security Development Lifecycle (or SDL), a process that Microsoft has adopted for the development of software that needs to withstand malicious attack. The process encompasses the addition of a series of security-focused activities and deliverables to each of the phases of Microsoft's software development process. These activities and deliverables include the development of threat models during software design, the use of static analysis code-scanning tools during implementation, and the conduct of code reviews and security testing during a focused "security push." Before software subject to the SDL can be released, it must undergo a Final Security Review by a team independent from its development group. When compared to software that has not been subject to the SDL, software that has undergone the SDL has experienced a significantly reduced rate of external discovery of security vulnerabilities. See The Trustworthy Computing Security Development Lifecycle.
Threat Modeling and BinScope Binary Analyzer, tools to enhance developer usability, are also being updated. These tools also are free and are accessible at Sottware Development Lifecycle. The threat modeling tool offers guidance on building and analyzing threat models, while the binary analyzer checks binaries to ensure they were built based on SDL requirements and recommendations.
A Microsoft consulting services option pertaining to SDL is being offered beginning in February 11. The goal is to improve software security and reduce both customer risk and costs of development. Services are being offered by the Microsoft Services group.