SDL Announcements
I’m in Barcelona, where my employer has made three announcements about our Security Development Lifecycle, which you can read about here: “SDL Announcements at TechEd EMEA.” [link to http://blogs.msdn.com/sdl/archive/2008/11/10/sdl-announcements-at-teched-emea.aspx no longer works]
I’m really excited about all three announcements: they represent an important step forward in helping organizations develop more secure code.
But I’m most excited about the public availability of the SDL Threat Modeling Tool. I’ve been working on this for the last 18 months. A lot of the thinking in “Experiences Threat Modeling at Microsoft” has been made concrete in this new tool, which helps any software engineer threat model.
I’m personally tremendously grateful to Meng Li, Douglas MacIver, Patrick McCuller, Ivan Medvedev and Larry Osterman. Each of them has contributed tremendously to making the tool what it is today. I’m also grateful to the many Microsoft employees who have taken the time to give me feedback, and I look forward to more feedback as more people use the tool.
Nice Adam. This is a great contribution to the world, especially if it becomes widely adopted.
-R