SAFECode: Writing Secure Code – learning from each other

During RSA Europe an industry forum called SAFECode (Software Assurance Forum for Excellence in Code) was announced "to identify and share software assurance best practices, promote broader adoption of such practices into the cyber ecosystem, and work with governments and critical infrastructure providers to leverage vendor practices to manage enterprise risks". I was really excited that I had to opportunity to represent Microsoft during the press conference at RSA as this is – from my point of view – a significant move for the industry. SAFECode was founded by some heavyweights in the software development industry: EMC2, Juniper, Symantec, SAP, and Microsoft.

Over the last few years we invested significantly into our Security Development Lifecycle (SDL). We make the experience we made available in different forms:

But this is different. Key people from Microsoft and other companies are coming together to share the best practices and learn from what worked and what did not. From our side, there are people involved like Steve Lipner (one of the "fathers" of SDL) and Michael Howard (Writing Secure Code). The outcome should be better processes as well as a way on how to integrate this kind of process into education and training. This is really great and I am excited to see this moving forward.

The press coverage was already pretty significant and positive:

SAFECode is neither a standards body nor a lobbying association. Instead it has been formed as a non-profit organization exclusively dedicated to increasing trust in information and communications technology products and services through the advancement of proven software assurance methods.

As a collaborative effort of leading technology companies committed to software assurance excellence, SAFECode provides a forum for subject matter experts to come together to work on some of the most challenging issues faced by the industry. There is no single solution or "right way" to address software assurance. Indeed, there are many different ways to succeed. SAFECode provides an opportunity to bring the best methods together in a manner that helps vendors, governments and critical infrastructures better manage risk.

Every technology vendor has a stake in the global effort to improve the security and reliability of the greater cyber ecosystem. If you are a vendor committed to driving security, privacy and integrity in software, hardware and services, then you belong in SAFECode. We are looking for hands-on members who want to benefit from the experiences of others and actively contribute to advancing the art of software assurance.