Security Development Lifecycle

Chapter 13. Stage 8: The Security Push

In this chapter:

Preparing for the Security Push

Training

Code Reviews

Threat Model Updates

Security Testing

Attack-Surface Scrub

Documentation Scrub

Are We Done Yet?

When Microsoft first embarked on the journey called Trustworthy Computing in 2002, the first major foray into changing the software development process was the security push. The goal of the push was simple: to hunt for security bugs, triage them, and fix them once the push was complete. The problem with doing security this way is that security pushes are not a sustainable way to produce secure software because a push misses the point of building secure systems. Building secure software requires you to reduce the chance that security bugs are created ...