Browse by Tags

All Tags » Security   (RSS)
Crispin has a blog!
28 April 08 11:08 AM
It had to happen. Since joining Microsoft a few short months ago, Crispin Cowen now has a blog . He's told me some of his ideas for posts... should make for an interesting read! He's never short on opinion. Read More...
Postedby michael_HOWARD | 1 Comments    
Filed under:
Oh No! Security Metrics!
18 April 08 08:33 AM
I just posted an article over on the SDL blog about security metrics in reponse to an analyst's criticisms of how we measure success/failure/progress. Comments always welcome. UPDATE David Litchfield just made a post on the subjet. Read More...
Postedby michael_HOWARD | 1 Comments    
Filed under:
Microsoft Security Development Lifecycle (SDL) 3.2 documentation now available for download
09 April 08 03:16 PM
Dave Ladd has just made a (long) post over on the SDL blog announcing the availability of the SDL 3.2 doc suite. This is a big deal. Read More...
Postedby michael_HOWARD | 3 Comments    
Filed under:
Internet Explorer 8.0 and Data Execution Prevention (DEP/NX)
08 April 08 01:23 PM
Eric Lawrence just posted some commentary about IE8 and DEP/NX. As you may know, IE7 supports DEP/NX, but it's disabled by default owing to compatibility issues. Well, DEP/NX is now enabled by default for IE8 when running on Windows Server 2008 and Window Read More...
Postedby michael_HOWARD | 2 Comments    
Filed under:
When adding security bugs to your code is not your fault!
04 April 08 02:55 PM
David LeBlanc and I (and a bunch of others) just had a little email exchange about some fascinating integer overflow vulnerabilities in gcc . Long story made short: the code you add to detect integer overflows might actually be removed by the compiler Read More...
Postedby michael_HOWARD | 19 Comments    
Filed under:
"How Do I?" Videos for Security
30 March 08 09:38 AM
These are pretty cool - I'm a big fan of highly focused, short education like this... http://msdn2.microsoft.com/en-us/security/bb896640.aspx Read More...
Postedby michael_HOWARD | 6 Comments    
Filed under:
IE8 Activity to lookup CVEs and Microsoft bulletins
18 March 08 08:06 PM
Update: Added Microsoft bulletin stuff. I'm always looking up CVEs so I want to get to the data as quickly as possible, especially if I'm digging through a load of them. Three years ago I posted some code to perform CVE lookup using Smart Tags in Microsoft Read More...
Postedby michael_HOWARD | 2 Comments    
Filed under:
Protecting Your Code with Visual C++ Defenses
17 March 08 04:28 PM
MSDN Magazine has just published an article I wrote that collects many of the various C and C++ defenses in the current Visual C++ compiler suite, all of these defenses are SDL requirements or recommendations. Read More...
Postedby michael_HOWARD | 6 Comments    
Filed under:
The impact of the SDL on Microsoft SQL Server
06 March 08 07:25 PM
Following on from my recent post about Windows Vista security and the SDL, a number of people have indicated to me that obvioulsy it's a fluke. It's important to point out that the reason I talk about Windows Vista so much is because I work in the Windows Read More...
Postedby michael_HOWARD | 1 Comments    
Filed under:
Some thoughts about Windows Server 2008
04 March 08 07:31 PM
Windows Server 2008 has shipped! And a fine product it is, too! Windows Server 2008 is the first Windows Server to go through the full SDL process, making it the most secure version of Windows Server to date. We raised the security bar in Windows Vista, Read More...
Postedby michael_HOWARD | 11 Comments    
Filed under:
The First Step on the Road to More Secure Software is admitting you have a Problem
21 February 08 06:31 AM
I just wrote an article over on the SDL blog about my observations from the industry to Jeff Jones' vulnerability analysis and the lack of security progress by our competitors. Read More...
Postedby michael_HOWARD | 9 Comments    
Filed under: ,
FAQ about HeapSetInformation in Windows Vista and Heap Based Buffer Overruns
18 February 08 05:26 PM
2/19 - Added some Minor Tweaks Perhaps it's the phase of the moon or something, but over the last few weeks I have received more email about correctly using the HeapSetInformation function than any other topic. I really don't know why! This was added Read More...
Postedby michael_HOWARD | 4 Comments    
Filed under: ,
Introducing SAFECode
14 February 08 07:27 PM
Today SAFECode , the Software Assurance Forum for Excellence in Code, introduced its first white paper, "Software Assurance: An Overview of Current Industry Best Practices." The organization was founded by Microsoft, Symantec, EMC, SAP and Juniper to Read More...
Postedby michael_HOWARD | 6 Comments    
Filed under:
More trustworthy election systems via SDL?
06 February 08 06:03 PM
My colleague Eric Bidstrup has just posted a thought provoking article on the SDL blog about elections software and the SDL. Read More...
Postedby michael_HOWARD | 1 Comments    
Filed under:
New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008
29 January 08 02:11 PM
In the interests of helping secure the platform, we want more people to opt-in to using Data Execution Prevention (aka DEP aka NX), and we have lowered the barrier to entry for application developers in Windows Vista SP1, Windows XP SP3 and Windows Server Read More...
Postedby michael_HOWARD | 23 Comments    
Filed under: ,
More Posts Next page »
Page view tracker