January 18, 2011, 5:35 PM — Microsoft is expanding its roster of SDL (security development lifecycle) tools and services with the beta release of an attack surface analyzer tool as well as the introduction of consulting services on secure development.
Microsoft's Attack Surface Analyzer is an SDL verification tool for developers and IT professionals to identify whether newly developed or installed applications inadvertently change the attack surface of a Microsoft OS. The free tool is downloadable from Microsoft's website and is the same tool used by internal Microsoft product development teams.
[ Also in the security and software development realms, the PHP language recently was beset by a bug discovered that could cause systems to face a denial of service attack. | Master your security with InfoWorld's interactive Security iGuide. ]
"Microsoft has required attack surface validation of applications prior to release for years -- however, assessing the attack surface of an application or software platform can be an intimidating process at first glance," said David Ladd, principal security manager at Microsoft, in a blog post. "To help ease the process, we are releasing a tool called Attack Surface Analyzer to assist both testers and IT pros in assessing the security of an application. The Attack Surface Analyzer is being released as a beta to allow us time to gather feedback and real-world usage data from our customers."
Microsoft also is updating its existing Threat Modeling and BinScope Binary Analyzer tools to enhance developer usability. These tools also are free and are accessible at Microsoft's security website. The threat modeling tool offers guidance on building and analyzing threat models, while the binary analyzer checks binaries to ensure they were built based on SDL requirements and recommendations.
"Consistent with the previous release of the tool, version 3.1.6 [of Threat Modeling] allows for early and structured analysis and proactive mitigation of potential security and privacy issues in new and existing applications," sad Ladd in the blog post. "The Microsoft SDL Threat Modeling Tool beta is enhanced to support Microsoft Visio 2010 for diagram design and also contains bug fixes reported to Microsoft by members of the security developer community." Version 3.1.6 is currently in a beta release stage.
"BinScope Binary Analyzer now supports Visual Studio 2010, making validation tasks readily available in the development environment. In addition, it integrates with Microsoft Team Foundation Server 2008 and Microsoft Team Foundation Server 2010 to output results into work items," Ladd said.
A Microsoft consulting services option pertaining to SDL is being offered beginning in February 11. The goal is to improve software security and reduce both customer risk and costs of development. Services are being offered by the Microsoft Services group.
Also, Microsoft is releasing a report it commissioned from Forrester Consulting, entitled "State of Application Security," studying the current state of application development practices. "There are a lot of interesting findings in the report that help validate the notion that addressing security early makes good business sense," Ladd said.
Microsoft making its security unveilings in conjunction with the Black Hat DC conference this week in Arlington, Va.
