Risk
2/17/2012
10:19 AM
50%
50%

How Microsoft Made Windows Secure From Ground Up

Microsoft's Steve Lipner, who was a major proponent of the need for a secure development methodology, talks about the successes of Microsoft's push--and the costs.

When Microsoft announced the Trustworthy Computing Initiative more than a decade ago, it seemed little more than a marketing push. Yet the company managed to create a sustained security program aimed at locking down its software. A key component of the initiative is the Secure Development Lifecycle (SDL), an iterative approach to programming that helps identify and resolve security weaknesses.

For more than a decade, the SDL has generated impressive results for Microsoft--leading, for example, to the decline of critical vulnerabilities in 2011 to their lowest level in five years.

Steven Lipner, the partner director of program management for Microsoft's Trustworthy Computing, had once held the belief that the computer security could be solved in a provable way. After a decade of working on Microsoft security, Lipner is the first to admit his former naivete. Dark Reading caught up with Lipner before the coming RSA Conference and talked about the success of the SDL and its costs.

DR: In what ways has the SDL paid off for Microsoft and its code base? What sort of metrics does Microsoft look at to gauge success or failure?
Lipner: In terms of measuring success, we look at a couple things. One of them is customer confidence--do people believe that we are in fact doing the right thing in developing software securely? And on that front, [a decade ago] Microsoft was not in the best position from a security perspective, whereas today we are in a much better position. So from that perspective, we view the initiative as successful.

Internally, we look at numbers, we look at metrics. We look at how many vulnerabilities, how many issues we have to fix. And that includes severity--how much impact do the vulnerabilities have on customers? We also look at the exploitability index. We have the exploitability index out for more than 18 months, and we are looking at that to say, OK, if there are vulnerabilities out there and they are discovered, how hard is it to exploit them and do harm to our customers?

Read the rest of this article on Dark Reading.

How can companies find and fix vulnerabilities before they lead to a breach? Better yet, how can software developers identify flaws in their applications before the new software is ever deployed? In this report, Eliminating Vulnerabilities In Enterprise Software, Dark Reading offers a look at some tips and tricks for software development and vulnerability assessment. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I decided to treat the kiddos to a TV dinner tonight.
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.