J.D. Meier's Blog : Videos

Video: Proven Practices for Security Engineering

J.D. Meier — Thu, 20 Dec 2007 05:39:33 GMT

This is an oldie but a goodie. Alex (from our original team) walks through our patterns & practices Security Engineering Approach. I knew the video exists, but I had a hard time finding it again so I'm posting the link here.

Video

MSDN Architecture Webcast: Proven Practices for Security Engineering (Level 300)

Key Changes
A few things have changed since our original video:

We changed from reviews to inspections (Security Design Inspection, Security Code Inspection, and Security Deployment Inspection) In our approach, we *inspect* for criteria.
MSDN moved our Security Engineering landing page.
We released Guidance Explorer which supports doing Security Inspections. It includes collections of security inspection questions, security principles, patterns and practices. See How To Use Guidance Explorer to Do a Security Code Inspection.

My Related Posts

Videos: Security, Performance Testing, and Visual Studio Team System

J.D. Meier — Thu, 22 Nov 2007 12:17:00 GMT

We posted our ASP.NET 2.0 security videos, performance testing videos, and Visual Studio Team System videos to the MSDN library.

Video Index

Video Index

ASP.NET 2.0 Security Videos
Keith Brown explains the mechanics behind some common input and data validation security issues and how to address them.

Performance Testing Videos
Scott Barber explains the big picture for how to approach performance testing as well as how to do workload modeling and performance reporting.

Visual Studio Team System Videos
Our team takes you through key source control concepts in Team Foundation Server.

I hope we produce more videos in the coming months. I particularly like factoring "explained" videos from the "how to" videos and keeping the videos short and focused. I think we have more work to do here, but I think we've learned key lessons each time we've done a batch of videos.

Performance Testing Videos Posted to CodePlex

J.D. Meier — Sat, 27 Oct 2007 08:20:00 GMT

Today we posted our Performance Testing Videos to CodePlex. They're a companion set for our patterns & practices Performance Testing Guidance for Web Applications.

Video Index
Here's a list of the videos:

Video: What Is - The Core Activities of Performance Testing (Length: 4:32 - Size: 3.02 MB)
Video: What Is - The Core Activities of Performance Testing in Agile Projects (Length: 3:02 - Size: 2.38 MB)
Video: What Is - The Core Activities of Performance Testing in CMMI Projects (Length: 2:55 - Size: 2.15 MB)
Video: What Is - The Distributions of Data for Performance Tests Results (Length: 3:32 - Size: 2.39 MB)
Video: What Is - The Reporting Fundamentals for Performance Test Data (Length: 1:58 - Size: 1.45 MB)
Video: What Is - The Success Criteria for Performance Test Projects (Length: 2:12 - Size: 1.49 MB)
Video: What Is - The Mathematical and Statistical Principles for Performance Testing (Length: 2:47 - Size: 1.83 MB)
Video: What Is - The Modeling Application Usage for Performance Testing (Length: 2:25 - Size: 1.70 MB)

Additional Resources

patterns & practices Performance Testing Guidance (Online KB)
patterns & practices Performance Testing Guidance for Web Applications (Guide)

New Video: How To - Personalize Team System Guidance with Guidance Explorer

J.D. Meier — Wed, 28 Mar 2007 09:20:00 GMT

If you are a hunter and gatherer of guidance, you'll want Guidance Explorer. Watch Video: How To - Personalize Team System Guidance with Guidance Explorer to see how you can use Guidance Explorer to build a custom collection of guidance from our Visual Studio Team System Guidance project. If you haven't used Guidance Explorer before, or it's been a while, you're in for a surprise. Seriously.

Guidance Explorer is a free tool to help you browse, find, organize, or even create your own guidance. When you launch Guidance Explorer, it synchronizes with our online store. For example, today's additions include a number of brand new Team System guidance items:

2 - Explained items
64 - FAQ items (these are actually our Questions and Answers)
43 - Mini How Tos (these are actually our Practices at a Glance)
6 - How Tos

My favorite Guidance Explorer features include:

Create collections of your favorite guidance (custom views)
Browse by checklists, code examples, how tos, guidelines (view by type)
Filter for just security, performance or Team System (Filter by technology, topic or category)
Share guidance among your teams (UNC share scenario)
Build a customized guide or whitepaper on the fly with exactly the parts you want (Save to Word, HTML or XML)
Create new guidance libraries and write your own personal guidance or checklists.

Keep in mind that Guidance Explorer is actually a diamond in the rough. It has its flaws, but it also has unique powers. For example, I could use Guidance Explorer to inform you of brand new, emerging security practices. I could also flag the top performance issues using the priority field. Imagine the alternative of hunting through a whitepaper or article, instead of organized collections and lists of actionable, guidance nuggets.

I know consultants that literally save themselves many hours per week by using Guidance Explorer as a personal knowledge base and for tailoring guidance for customers. I also know of customers using Guidance Explorer as a light-weight and effective way to share guidance among their development teams. It's actually the type of tool where customers surprise me what they use it for.

While Guidance Explorer has nearly 1100 guidance nuggets at last count (across security, performance and .NET 1.1. and 2.0), you can quickly shrink the haystacks to find the needle that you need (Ed and I call this our Shrinking Haystack pattern). You can also discover relationships among the guidance, because related items are linked. Don't take my word for it though, test drive it for yourself. Did I mention it's free? Oh yeah, I should also mention it comes with source, so shape it to your heart's content.

Go ahead and watch Video: How To - Personalize Team System Guidance with Guidance Explorer and then download Guidance Explorer. If you do use Guidance Explorer and you have a story you'd like to share, please leave a comment in this post.

New Video: What Is - Branching

J.D. Meier — Tue, 27 Mar 2007 10:31:00 GMT

We just added Video: What Is - Branching to our Visual Studio Team System Guidance Project. Watch this video to see how branching may impact your strategy when using Team Foundation Server source control.

New Video: What Is - New in Team Foundation Server Source Control

J.D. Meier — Tue, 27 Mar 2007 09:52:00 GMT

We added Video: What Is - New in Team Foundation Server Source Control to our Visual Studio Team System Guidance Project. Watch this video if you want a brief highlight of some of the differences between Visual Source Safe and Team Foundation Server: It's one of our first "What Is" type videos as part of our Video-Based Guidance Experiment.

Video-Based Guidance for Visual Studio Team System Now Available

J.D. Meier — Mon, 26 Mar 2007 08:51:00 GMT

As part of our Video-Based Guidance Experiment, we've released an initial set of VSTS Guidance Videos.

Source Control Videos

Video: How To - Setup Your Source Tree in Team Foundation Server (Length: 10:02 - Size: 4.2 MB)
Video: How To - Structure Your ASP.NET Projects for TFS (Length: 5:40 - Size: 3.8 MB)
Video: How To - Migrate from VSS to Team Foundation Source Control (Length: 5:20 - Size: 3.4 MB)

Test drive our videos and help shape our experiment by either leaving your comments here or sending your feedback to vsguide@microsoft.com

Enjoy!

patterns & practices Security Videos

J.D. Meier — Sat, 24 Mar 2007 02:31:00 GMT

We did a focused set of security videos with Keith Brown a while back. The problem is they're not very findable (most customers I talk to aren't aware of them). I added them to soapbox and listed them below to see if it helps (note soapbox may prompt you to log in):

Input and Data Validation Videos

Paths, URLs, and Canonicalization - shows you how to avoid input and data validation security issues related to path validation.
Cookies and Tamper Detection - shows you how to protect from cookie tampering issues.
Cross Site Scripting - shows you how to protect from cross-site scripting issues.
Regular Expressions - shows you how to use regular expressions to validate input and data.
SQL Injection - shows you how to protect from SQL injection.
ASP.NET Validation Controls - shows you how to use validation controls for input validation.

They're designed to help you get key concepts behind some of our security guidance. I also wanted to use somebody that was recognized in the field as somebody you could trust. Keith's proven himself for a long time in the security community. He also has the aura of an experienced trainer, which I think comes across in these videos.

patterns and practices Security Training Modules Pilot

J.D. Meier — Thu, 23 Feb 2006 00:13:00 GMT

Want to see some short training videos and labs by Keith Brown on some common security issues?

I thought it would be great to do a pilot around modular, self-paced training. By modular, I mean you get a video that's 10 minutes or less, and a lab that's 20 minutes or less.

The Pilot

patterns & practices Security Training Modules Index

Modular, Relevant, Real-World

To make the training valuable, I wanted to improve on a few things:

Whenever, wherever. I didn't want to have to be in a class-room to get the quick and dirty training to get my job done.
Modular. I don't have big chunks of time. I need training I could incrementally consume as I want it or have time for it.
Relevant. I wanted to be able to get training for a specific task at hand. Again, it helps to be modular.
Realworld. Sometimes training can be academic. I wanted training that was relevant to both the guidance and tempered with real-world scenarios.

Scenarios
For some simple usage scenarios, I had the following in mind:

See a single lab page for a specific task (for example, cross-site scripting)
Watch a short video.
Work through a small lab.
Get the relevant guidance.

The idea was that the community could help point each other to more fine-grained training or big picture as needed. On my end, I could point to the training to help walk customers through our patterns & practices Security Guidance.

Training Layout
The modules are laid out as follows:

Each lab has it's own page, which includes both a video and a lab. Sample: SQL Injection Lab
Related labs roll up into an index for a topic. Sample: Input Validation Modules
All the topics roll up into an index. Sample: Security Training Modules Index

All pages are simple and bare by design (to render more as we learn more and based on feedback). The key to having a page per lab means we'll be able to provide fine-grained access and jumps from guidance.

More Information

For more information about the patterns & practices Security Training Modules, see About the patterns & practices Security Training Modules