Security

I've been reading the book Writing Secure Code by Michael Howard and David LeBlanc (both I believe from Microsoft). Today I was able to spend my morning in a MS training course taught by Michael Howard, I think it was titled Security Basics or something like that. It is apparently a required course for all technical positions at MS. It was actually pretty good, and exposed me to a lot of the security world that I had not been involved in previously. I know a lot of my past co-workers when they hear me talk about Security at Microsoft, I too had the same impression of MS as being at the bottom of the security barrel. But one thing that I am realizing after 6 weeks of working here is that the years of pain and issues that MS has endured over security have woken them up to this issue and it is one that they are taking very seriously now. There seems to be an air of importance around the whole issue, one that flatly did not exist at Sun when I was working there. Sun has a much better reputation in this area, but I have always wondered if it wasn't more that they have not been as much of a target as MS has historically been. Being a target likely makes it so that more vulnerabilities are discovered than in products not being targeted, but hopefully eventually leads to more secure products (which it seems may be happening). One has to wonder if other products are really more secure or the vulerabilities just have not yet been exposed. I don't know...

Anyhow, this book (Writing Secure Code) follows a well defined process, the MS Security Development Lifecycle, and layes out a lot of fundamental steps to analyzing security for products. These are things that I wish I had known on some of my past projects, but just did not have the information. It goes through designing secure software, threat modelling, secure coding guidelines, minimizing attack surface, and testing techniques (like fuzz testing, penetration testing, etc.). The book then dives deeply into code looking into common, well known issues like buffer overruns, ACL's, least privilege, handling input data and a lot more. One interesting thing that we got in the course was to look at the code from Windows and other MS products that were the cause of many of the most well known security vulnerabilities like different worms as other such things. All in all, the book is a fantastic guide that I should have read years ago, and one that I highly recommend to anyone involved in software.