Welcome to the Microsoft Security Newsletter - a monthly newsletter for IT professionals and developers bringing security news, guidance, updates, and community resources direct to your inbox. To view an online version of this newsletter, please click here. If you would like to receive less technical security news, guidance and updates, please subscribe to the Microsoft Security for Home Computer Users Newsletter.
Viewpoint
|
|
By Michael Howard, Principal Security Program Manager, Microsoft Corporation
At the end of the day, you improve security by focusing on security. Explore how -- and, more importantly, why -- the Security Development Lifecycle (SDL) has resulted in a reduction in vulnerabilities across major Microsoft products, including Windows Vista.
|
Top Stories
|
|
As part of its commitment to a more secure and trustworthy computing ecosystem, Microsoft is making the details of the SDL process generally available online for the first time. IT policy makers and software development organizations can leverage this content to enhance and inform their own software security and privacy assurance programs.
|
|
|
Read Microsoft's End to End Trust whitepaper and join an online discussion forum about building a more secure and privacy enhanced Internet.
|
|
|
See firsthand how Microsoft System Center Mobile Device Manager with Windows Mobile 6.1 can help improve mobile device security, simplify management, and lower costs. Download the 120-day Trial Evaluation software.
|
|
|
Microsoft Forefront codename "Stirling" is an integrated security system that delivers comprehensive, coordinated protection across endpoints, server applications, and the network edge. It provides simplified management and critical visibility that make security easier to manage and control. Register today and you'll automatically receive access to valuable beta resources throughout the evaluation experience.
|
|
|
Download a free trial or take a virtual lab of Forefront Client Security, Forefront Security for Exchange Server or Forefront Security for SharePoint and be entered for a chance to win great prizes. Find out more at Evalu'08.
|
Security Guidance
|
|
By Jeremy Dallman, Security Program Manager, Microsoft Security Engineering & Communications
Learn how to establish a baseline architectural understanding of your application security, one that identifies critical weaknesses and provides enough evidence to support the decision to move forward with a full SDL adoption.
|
|
|
Learn about prioritizing code by age, using analysis tools and automation, looking at threats from multiple angles, and the importance of education.
|
|
|
This article presents that list of habits shared by developers of secure code. From taking responsibility to using the best tools available, these habits can help make you a more secure developer.
|
|
|
Read about some of the buffer overrun defenses available in Visual C++ 2005 and beyond.
|
|
|
HelloSecureWorld.com provides a powerful experience for promoting security awareness and education in the developer community by surfacing existing content as well as new.
|
This Month's Security Bulletins
Critical:
Important:
Community / MVP Update
|
|
Reza Alirezaei is a principal architect with a background in Microsoft SharePoint technologies, BI, and .NET development. He has been involved with SharePoint since its Tahoe days (SPS 2001) and has worked with many large enterprises to help them realize the benefits from adopting this great platform. Originally from Iran, Reza moved to Canada in late 2004 and soon received his first MVP award in SQL Server Reporting Services. In 2007, he was nominated and awarded MVP status for the second time in Microsoft Office SharePoint Server.
|
|
|
By Reza Alirezaei, Microsoft Office SharePoint Server 2007 MVP
Security principles in the world of programming using the SharePoint object model usually boil down to two key principles at design and development stages: know your threat model and know what security context your code runs on behalf of. Read this article for detailed security best practices that you can implement during the design and development stages of building business solutions on the SharePoint platform.
|
Partners with Expertise in Security Solutions
|
|
An innovative leader in automated application security assessment, Cenzic offers software that tests Web applications in a stateful manner and emulates a hacker, thereby producing manual penetration testing results in a cost-effective way. Cenzic solutions provide application security quality assurance that assists companies in detecting and managing security vulnerabilities, testing for application logic, and enforcing security policies throughout the Software Development Life Cycle (SDLC).
|
|
|
A number of Visual Studio Industry Partners provide tools to help identify and resolve security vulnerabilities and enact secure development practices across the software development lifecycle. To reduce training times and enhance productivity, most tools designed to aid in the creation of secure code are integrated with the Visual Studio IDE, so developers can use these features from within a familiar environment.
|
Microsoft Product Lifecycle Information
Security Events and Training
|
|
Learn from Microsoft and industry experts, connect with your peers, and choose from over 1,000 learning opportunities including Security or Identity and Access track sessions. Tech-Ed is the premier technical education conference from Microsoft and now features separate conferences for IT professionals and developers. Plus, an online session catalog makes it easy for you to create a custom-fit schedule. Don't miss your opportunity. Register now.
|
|
|
Discover how you can develop applications using the principle of least privilege with UAC. We explain how developing with UAC reduces the security exposure and the attack surface of both the operating system and user-developed applications. We also provide best practices for developing and managing UAC, ensuring compatibility with existing applications, and coding to take advantage of UAC protection
|
Upcoming Security Webcasts
|
|
Thursday, April 10, 9:30 AM Pacific Time
John Albertson, Microsoft IT Mobile Service Planner, Microsoft Corporation
|
|
|
Upcoming security webcasts in a dynamic, interactive format.
|
For IT Professionals
For Developers
Microsoft On-Demand Webcasts
| • |
|
| • |
TechNet Webcast: How to Overcome the Top 10 Mobile Device Security and Management Challenges (Level 200)
Learn how you can improve secure access to corporate data and line-of-business (LOB) applications and simplify management of Windows Mobile devices with Microsoft System Center Mobile Device Manager, a single, end-to-end solution for comprehensive mobile device security and management. We explain how System Center Mobile Device Manager provides integration into Active Directory, rich inventory and reporting tools, secure virtual private network (VPN) access, and more.
|
|
Back to newsletter list
