Building More Secure Commercial Software: The Trustworthy Computing Security Development Lifecycle

With the growth of the Internet as a vehicle for commercial, governmental, and personal communications and information sharing, the importance of providing trustworthy computing facilities that will resist hostile attack has grown dramatically. In response to this growing need, Microsoft has developed the Trustworthy Computing Security Development Lifecycle (SDL), an integrated process for improving the security of commercial software as it is being developed. This paper describes the phases of the SDL from initial requirements definition through the Final Security Review before software release, and summarizes some of the improvements in security demonstrated by software that has completed the SDL.