The Security Development Lifecycle

Your customers demand and deserve better security and privacy in their software. This book is the first to detail a rigorous, proven methodology that measurably minimizes security bugsthe Security Development Lifecycle (SDL). In this long-awaited book, security experts Michael Howard and Steve Lipner from the Microsoft Security Engineering Team guide you through each stage of the SDLfrom education and design to testing and post-release. You get their first-hand insights, best practices, a practical history of the SDL, and lessons to help you implement the SDL in any development organization.

The Security Development Lifecycle: SDL: A Process for Developing Demonstrably More Secure Software; Introduction; Organization of This Book; Part II, "The Security Development Lifecycle Process"; Part III, "SDL Reference Material"; The Future Evolution of the SDL; What's on the Companion Disc?; System Requirements; Acknowledgments; References; I. The Need for the SDL; Another Factor That Influences Security: Reliability; It's Really About Quality; Why Major Software Vendors Should Create More Secure Software; Why In-House Software Developers Should Create More Secure Software.

Why Small Software Developers Should Create More Secure SoftwareSummary; References; 2. Current Software Development Methods Fail to Produce Secure Software; Understanding Security Bugs; Critical Mass; "Many Eyeballs" Misses the Point Altogether; Proprietary Software Development Methods; Agile Development Methods; Common Criteria; Summary; References; 3. A Short History of the SDL at Microsoft; New Threats, New Responses; Windows 2000 an.