Risk
2/3/2010
04:37 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Black Hat: Microsoft Enhances SDL Offerings

The world's largest software company aims to help third-party developers write code that's more secure.

At the Black Hat security conference in Washington, D.C., on Tuesday, Microsoft introduced new software, a new membership program, and guidance to enhance its Secure Development Lifecycle (SDL) development methodology.

The software is the first public beta of MSF for Agile Software Development plus SDL Process Template for VSTS 2008, MSF-A+SDL for short, a template that helps development teams integrate SDL processes into their Visual Studio Team System development environment.

It is based on Microsoft's SDL-Agile processes, which aim to provide structure for development projects that happen on a more accelerated time line than the typical SDL project.

A version of the template for Visual Studio 2010 will be available shortly after Visual Studio 2010 is released in April.

Microsoft is also expanding its SDL Pro Network to include a new membership category called Tools. Organizations that join as Tools members provide services related to the deployment of security tools, like static analyzers, fuzzers, or binary analyzers.

The company announced seven new SDL Pro Network members: Fortify, Veracode, and Codenomicon in the Tools category; Booz-Allen Hamilton, Casaba Security, and Consult2Comply in the Consulting Member category; and Safelight Security Advisors in the Training Member category.

Finally, Microsoft released a white paper titled Simplified Implementation of the Microsoft SDL. In so doing, it hopes to convey that organizations don't have to be as large as Microsoft, and don't have to be using Microsoft development tools, to benefit from the company's secure development practices.

Microsoft's interest in helping third-party developers improve their code reflects the company's finding that during the first six months of 2009, 81% of reported vulnerabilities were in non-browser applications, 5% were in Microsoft products, and the remaining flaws were in Web browsers.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report