Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Microsoft adds to security tools for developers

Attack Surface Analyzer security development lifecycle verification tool offered along with consulting services for secure development

Microsoft is expanding its roster of SDL (security development lifecycle) tools and services with the beta release of an attack surface analyzer tool as well as the introduction of consulting services on secure development.

Microsoft's Attack Surface Analyzer is an SDL verification tool for developers and IT professionals to identify whether newly developed or installed applications inadvertently change the attack surface of a Microsoft OS. The free tool is downloadable from Microsoft's website and is the same tool used by internal Microsoft product development teams.

[ Also in the security and software development realms, the PHP language recently was beset by a bug discovered that could cause systems to face a denial of service attack. | Master your security with InfoWorld's interactive Security iGuide. ]

"Microsoft has required attack surface validation of applications prior to release for years -- however, assessing the attack surface of an application or software platform can be an intimidating process at first glance," said David Ladd, principal security manager at Microsoft, in a blog post. "To help ease the process, we are releasing a tool called Attack Surface Analyzer to assist both testers and IT pros in assessing the security of an application. The Attack Surface Analyzer is being released as a beta to allow us time to gather feedback and real-world usage data from our customers."

Microsoft also is updating its existing Threat Modeling and BinScope Binary Analyzer tools to enhance developer usability. These tools also are free and are accessible at Microsoft's security website. The threat modeling tool offers guidance on building and analyzing threat models, while the binary analyzer checks binaries to ensure they were built based on SDL requirements and recommendations.

"Consistent with the previous release of the tool, version 3.1.6 [of Threat Modeling] allows for early and structured analysis and proactive mitigation of potential security and privacy issues in new and existing applications," sad Ladd in the blog post. "The Microsoft SDL Threat Modeling Tool beta is enhanced to support Microsoft Visio 2010 for diagram design and also contains bug fixes reported to Microsoft by members of the security developer community." Version 3.1.6 is currently in a beta release stage.

"BinScope Binary Analyzer now supports Visual Studio 2010, making validation tasks readily available in the development environment. In addition, it integrates with Microsoft Team Foundation Server 2008 and Microsoft Team Foundation Server 2010 to output results into work items," Ladd said.

A Microsoft consulting services option pertaining to SDL is being offered beginning in February 11. The goal is to improve software security and reduce both customer risk and costs of development. Services are being offered by the Microsoft Services group.

Also, Microsoft is releasing a report it commissioned from Forrester Consulting, entitled "State of Application Security," studying the current state of application development practices. "There are a lot of interesting findings in the report that help validate the notion that addressing security early makes good business sense," Ladd said.

Microsoft making its security unveilings in conjunction with the Black Hat DC conference this week in Arlington, Va.

This article, "Microsoft adds to security tools for developers," was originally published at InfoWorld.com. Follow the latest developments in business technology news and get a digest of the key stories each day in the InfoWorld Daily newsletter. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Read more about developer world in InfoWorld's Developer World Channel.

Related Articles

  1. Google tells Microsoft to shut down its YouTube ...

  2. How can we keep infosec pros a step ...

  3. CMO interview: Becoming a change agent

    CMO

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Hewlett-Packard, HP, Microsoft, SDL, Visio
References show all
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: application development, Developer World, Microsoft, security, software, Security Central
Latest Blog Posts
Whitepapers
  • Vodafone Ireland Implements World-Class Service Excellence with HP BSM
    Shane Gaffney, head of IT operations explain how HP Business Service Manager solutions have helped Vodafone to transform from a reactive to a proactive IT Operations function, and to align their priorities to match the business and drive business value, delivering 300% ROI in one year. Download today.
    Learn more »
  • Protecting Your Data, Intellectual Property, and Brand from Cyber Attacks
    Enterprises and government agencies are under virtually constant attack today. It is clear that the cybercriminals, nation-states, and hacker activists waging these attacks are growing increasingly sophisticated and more effective in their efforts to steal and sabotage. Why are today’s security defenses failing? In this battle, your security teams are using outdated arsenal - download now to learn more.
    Learn more »
  • Agentless Security for Virtual Environments
    Virtualised datacentres, desktops, and cloud computing should be secured by the same strong protection technologies as physical machines. However, traditional agent-based solutions that are not architected for virtualisation can result in a number of significant operational security issues. Find out more about the first agentless security platform solution.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments