Michael Howard's Web LogA Simple Software Security Guy at Microsoft!Crispin has a blog!- April 28, 2008 It had to happen. Since joining Microsoft a few short months ago, Crispin Cowen now has a blog. He's told me some of his ideas for posts... should make for an interesting read! He's never short on opinion.http://blogs.msdn.com/michael_howard/archive/2008/04/28/crispin-has-a-blog.aspx Oh No! Security Metrics!- April 18, 2008 I just posted an article over on the SDL blog about security metrics in reponse to an analyst's criticisms of how we measure successfailureprogress. Comments always welcome. UPDATE David Litchfield just made a post on the subjet.http://blogs.msdn.com/michael_howard/archive/2008/04/18/oh-no-security-metrics.aspx Microsoft Security Development Lifecycle (SDL) 3.2 documentation now available for download- April 9, 2008 Dave Ladd has just made a (long) post over on the SDL blog announcing the availability of the SDL 3.2 doc suite. This is a big deal.http://blogs.msdn.com/michael_howard/archive/2008/04/09/microsoft-security-development-lif... Internet Explorer 8.0 and Data Execution Prevention (DEPNX)- April 8, 2008 Eric Lawrence just posted some commentary about IE8 and DEPNX. As you may know, IE7 supports DEPNX, but it's disabled by default owing to compatibility issues. Well, DEPNX is now enabled by default for IE8 when running on Windows Server 2008 and Window Vista SP1 and later :-) If you build any form of extensibility mechanism for IE, you should read his post.http://blogs.msdn.com/michael_howard/archive/2008/04/08/internet-explorer-8-0-and-data-exe... When adding security bugs to your code is not your fault!- April 4, 2008 David LeBlanc and I (and a bunch of others) just had a little email exchange about some fascinating integer overflow vulnerabilities in gcc. Long story made short: the code you add to detect integer overflows might actually be removed by the compiler because of assumptions made by the optimizer. I was going to write a post on the subject, but David did it for me :-) A frankly, no-one knows int-overflow science quite like LeBlanc. I can't help but be reminded of another compiler optimization...http://blogs.msdn.com/michael_howard/archive/2008/04/04/when-adding-security-bugs-to-your-... |