Pre-SDL Requirements: Security Training
Education and Awareness
All members of software development teams should receive appropriate training to stay informed about security basics and recent trends in security and privacy. Individuals who develop software programs should attend at least one security training class each year. Security training can help ensure software is created with security and privacy in mind and can also help development teams stay current on security issues. Project team members are strongly encouraged to seek additional security and privacy education that is appropriate to their needs or products.
A number of key knowledge concepts are important to successful software security. These concepts can be broadly categorized as either basic or advanced security knowledge. Each technical member of a project team (developer, tester, program manager) should be exposed to the knowledge concepts in the following subsections.
On This Page
Secure design, including the following topics:
Attack surface reduction
Defense in depth
Principle of least privilege
Threat Modeling, including the following topics:
Overview of threat modeling
Design to a threat model
Coding to a threat model
Testing to a threat model
Secure Coding, including the following topics:
Integer arithmetic errors
Cross site scripting
Managed code issues (Microsoft .NET/Java)
Security Testing, including the following topics:
Security testing versus Functional testing
Privacy, including the following topics:
Types of privacy data
Privacy design best practices
Privacy development best practices
Privacy testing best practices
The preceding training concepts establish an adequate knowledge baseline for technical personnel. As time and resources permit, it is recommended that you explore other advanced concepts. Examples include (but are not limited to):
Security design and architecture
User interface design
Security concerns in detail
Security response processes
Implementing custom threat mitigations
All developers, testers, and program managers must complete at least one security training class each year. Individuals who have not taken a class in the basics of security design, development, and testing must do so.
At least 80 percent of the project team staff who work on products or services must be in compliance with the standards listed earlier before their product or service is released. Relevant managers must also be in compliance with these standards. Project teams are strongly encouraged to plan security training early in the development process so that training can be completed as early as possible and have a maximum positive effect on the project’s security.
We recommend that staff who work in all disciplines read the following publications:
Writing Secure Code , Second Edition(ISBN 9780735617223; ISBN: 0-7356-1722-8)
Uncover Security Design Flaws Using The STRIDE Approach (ISBN: 0-7356-1991-3).
Microsoft recommends that staff who works in all disciplines read the following documents:
The Security Development Lifecycle (ISBN 9780735622142; ISBN-10 0-7356-2214-0), Chapter 5: Stage 0 – Education and Awareness
Privacy: What Developers and IT Professionals Should Know (ISBN-10: 0-321-22409-4; ISBN-13: 978-0-321-22409-5)
This documentation is not an exhaustive reference on the SDL process as practiced at Microsoft. Additional assurance work may be performed by product teams (but not necessarily documented) at their discretion. As a result, this example should not be considered as the exact process that Microsoft follows to secure all products.
This documentation is provided “as-is.” Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it.
This documentation does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.
© 2012 Microsoft Corporation. All rights reserved.