Microsoft To Expand Security Lifecycle Expertise

Microsoft is crossing the aisles to see the security process through from start to finish--not just internally, but for outside software developers too. The company plans to export its Security Development Lifecycle (SDL) process to a greater extent by releasing tools and support to IT pros later this fall, Redmond said this week.

The software giant wants to support developers in building fortified apps, starting at the design and development phase with SDL.

SDL is a "software security assurance process" that has been in place as part of Microsoft's internal architectural policy, going as far back as 2004, explained Steve Lipner, Microsoft's senior director of security engineering strategy for the Trustworthy Computing Group, in a Microsoft-published Q&A.

The SDL methodology, he said, has led to security improvements in flagship products such as Windows Vista and SQL Server. In recent months, hackers have favored attacks on SQL Server solutions via the Internet, although Microsoft has explained the vulnerability as due to insecure Web pages and Web applications.

SDL allows development managers and IT policy-makers to "assess the state of their secure software development practices and to create a vision and road map for reducing customer risk," Lipner explained.

In an effort to broaden its SDL practices, Microsoft is planning a three-pronged rollout, beginning in November.

First, Microsoft plans to make its SDL optimization model (PDF) freely available via a download on MSDN.

Second, if IT pros want to consult security experts, Redmond is forming a "SDL Pro Network," which will be available in November. The network will include trained independent channel partners and Microsoft staff members in the United States and Europe.

Microsoft also generally plans to share its SDL concepts with independent software vendors, partners and customers as a means to achieving security and privacy throughout the "entire computing ecosystem."

Finally, Microsoft plans to release an SDL Threat Modeling Tool 3.0 (PDF) in November. The tool is similar to risk assessment and analysis solutions used to map enterprise IT security.

Microsoft's SDL announcement is part of the company's broader outreach on security. In August at the Black Hat Conference, Microsoft promoted a more collaborative effort on security issues. It also promised for greater transparency during its security patch release cycles.

About the Author

Jabulani Leffall is a business consultant and an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others. He consulted for Deloitte & Touche LLP and was a business and world affairs commentator on ABC and CNN.

Featured

  • open laptop in a college classroom with holographic AI icons like a brain and data charts rising from the screen

    4 Ways Universities Are Using Google AI Tools for Learning and Administration

    In a recent blog post, Google shared an array of education customer stories, showcasing ways institutions are using AI tools like Gemini and NotebookLM to transform both learning and administrative tasks.

  • illustration of a human head with a glowing neural network in the brain, connected to tech icons on a cool blue-gray background

    Meta Launches Stand-Alone AI App

    Meta Platforms has introduced a stand-alone artificial intelligence app built on its proprietary Llama 4 model, intensifying the competitive race in generative AI alongside OpenAI, Google, Anthropic, and xAI.

  • three main icons—a cloud, a user profile, and a padlock—connected by circuit lines on a blue abstract background

    Report: Identity Has Become a Critical Security Perimeter for Cloud Services

    A new threat landscape report points to new cloud vulnerabilities. According to the 2025 Global Threat Landscape Report from Fortinet, while misconfigured cloud storage buckets were once a prime vector for cybersecurity exploits, other cloud missteps are gaining focus.

  • Stylized illustration showing cybersecurity elements like shields, padlocks, and secure cloud icons on a neutral, minimalist digital background

    Microsoft Announces Security Advancements

    Microsoft has announced major security advancements across its product portfolio and practices. The work is part of its Secure Future Initiative (SFI), a multiyear cybersecurity transformation the company calls the largest engineering project in company history.