Last year, Microsoft unveiled SDL (Microsoft's proprietary Security Development Lifecycle) to a few select customers who are active on the .NET and Windows platform. The response was overwhelmingly positive and this week Microsoft announced its SDL Pro Network initiative -- a collection of third-party security companies authorized to help organizations formally adopt and roll out SDL through training, consulting, and products at their disposal. (see: www.microsoft.com/sdl and http://download.microsoft.com/download/0/E/9/0E9AC448-30B2-4451-9E23-46244AFABB7F/Microsoft%20SDL%20Pro%20Network%20_Fact%20Sheet.pdf for more detail.)
It’s about time. For years, organizations have maintained a reactive position to software security related issues. Only in the most progressive development organizations has there been education and tooling put in place to build security into software. The SDL program from Microsoft represents the largest effort to date to create some standards for security development best practices.
Jon Oltsik of Enterprise Strategy Group thinks, “Microsoft deserves high praise for creating, formalizing, and improving SDL as it has led to better software for the masses.... Organizations that embrace SDL can improve the security of their code while decreasing the cost of maintenance and security operations—a true win-win.” (see http://www.enterprisestrategygroup.com/ESGPublications/BriefPopup.asp?ReportID=1093)
Right on, Jon! This initiative will help organizations tackle specific challenges in developing secure applications on the Windows and .NET platforms and mitigate consumer risk through the use of more secure software. In the absence of an industry standard, I would love to see widespread adoption of SDL and have it evolve into an accepted standard. Without a baseline for secure software development, it is difficult for consumers and vendors alike to properly assess what "due diligence" is being taken with respect to secure software development and how to benchmark subsequent efforts.
I do believe that many organizations WANT to develop and deploy more software, but they don't have the knowledge or blueprint to do so. This initiative provides definitive guidance that will give organizations the confidence and direction they need in their pursuit of secure software development.
Will Microsoft SDL change the world? Certainly not overnight. But this is certainly a step in the right direction and I, for one, applaud Microsoft's efforts - both internally and publicly.
