Menu
Microsoft adds to security tools for developers

Microsoft adds to security tools for developers

Attack Surface Analyzer security development lifecycle verification tool offered along with consulting services for secure development

Microsoft is expanding its roster of SDL (security development lifecycle) tools and services with the beta release of an attack surface analyzer tool as well as the introduction of consulting services on secure development.

Microsoft's Attack Surface Analyzer is an SDL verification tool for developers and IT professionals to identify whether newly developed or installed applications inadvertently change the attack surface of a Microsoft OS. The free tool is downloadable from Microsoft's website and is the same tool used by internal Microsoft product development teams.

[ Also in the security and software development realms, the PHP language recently was beset by a bug discovered that could cause systems to face a denial of service attack. | Master your security with InfoWorld's interactive Security iGuide. ]

"Microsoft has required attack surface validation of applications prior to release for years -- however, assessing the attack surface of an application or software platform can be an intimidating process at first glance," said David Ladd, principal security manager at Microsoft, in a blog post. "To help ease the process, we are releasing a tool called Attack Surface Analyzer to assist both testers and IT pros in assessing the security of an application. The Attack Surface Analyzer is being released as a beta to allow us time to gather feedback and real-world usage data from our customers."

Microsoft also is updating its existing Threat Modeling and BinScope Binary Analyzer tools to enhance developer usability. These tools also are free and are accessible at Microsoft's security website. The threat modeling tool offers guidance on building and analyzing threat models, while the binary analyzer checks binaries to ensure they were built based on SDL requirements and recommendations.

"Consistent with the previous release of the tool, version 3.1.6 [of Threat Modeling] allows for early and structured analysis and proactive mitigation of potential security and privacy issues in new and existing applications," sad Ladd in the blog post. "The Microsoft SDL Threat Modeling Tool beta is enhanced to support Microsoft Visio 2010 for diagram design and also contains bug fixes reported to Microsoft by members of the security developer community." Version 3.1.6 is currently in a beta release stage.

"BinScope Binary Analyzer now supports Visual Studio 2010, making validation tasks readily available in the development environment. In addition, it integrates with Microsoft Team Foundation Server 2008 and Microsoft Team Foundation Server 2010 to output results into work items," Ladd said.

A Microsoft consulting services option pertaining to SDL is being offered beginning in February 11. The goal is to improve software security and reduce both customer risk and costs of development. Services are being offered by the Microsoft Services group.

Also, Microsoft is releasing a report it commissioned from Forrester Consulting, entitled "State of Application Security," studying the current state of application development practices. "There are a lot of interesting findings in the report that help validate the notion that addressing security early makes good business sense," Ladd said.

Microsoft making its security unveilings in conjunction with the Black Hat DC conference this week in Arlington, Va.

This article, "Microsoft adds to security tools for developers," was originally published at InfoWorld.com. Follow the latest developments in business technology news and get a digest of the key stories each day in the InfoWorld Daily newsletter. For the latest developments in business technology news, follow InfoWorld.com on Twitter.

Read more about developer world in InfoWorld's Developer World Channel.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Microsoftsoftwareapplication developmentDeveloper WorldSecurity Central

Featured

Slideshows

Reseller News Platinum Club celebrates leading partners in 2019

Reseller News Platinum Club celebrates leading partners in 2019

The leading players of the New Zealand channel came together to celebrate a year of achievement at the annual Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months.

Reseller News Platinum Club celebrates leading partners in 2019
Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosts alumnae breakfast for Women in ICT Awards

Reseller News hosted its second annual alumnae breakfast for the Women in ICT Awards in New Zealand, designed to showcase the leading female leaders in the industry. Held at The Cordis in Auckland, attendees came together to hear inspiring keynotes and panel discussions, alongside high-level networking among peers. Photos by Gino Demeer.

Reseller News hosts alumnae breakfast for Women in ICT Awards
Reseller News Innovation Awards 2019: meet the winners

Reseller News Innovation Awards 2019: meet the winners

Reseller News honoured the standout players of the New Zealand channel in front of more than 480 technology leaders in Auckland on 23 October, recognising the achievements of top partners, emerging entrants and innovative start-ups.

Reseller News Innovation Awards 2019: meet the winners
Show Comments