After a wobbly start, everyone really kicked into gear and we started making good progress. This is the fifth week now out of a total of six, and things are looking great. We found a few areas where we needed to change the design to make the product more secure, and we fixed issues reported by scanning tools like FxCop and PreFast (if you want to try this one out, check out the December CTP). We also updated our threat models to include the latest changes, and we’ve reviewed a ton of source code.

In a month or so, our central security team (for the company) will be engaging our team for our "Final Security Review" (see Soma’s blog about the Security Development Lifecycle). Every product shipped by Microsoft needs to go through one of these and can not ship without passing it. The central security team is a group of security experts who verify that a product meets the security bar defined for MS products (listen to Mike Howard talking about this in his MSDN TV episode). During February and March, they will be focusing on testing our product. It’s always useful when outside eyes are looking at your product, they may find things we somehow missed.