Channel 9 - Entries tagged with sdl-lob Microsoft http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.png Channel 9 - Entries tagged with sdl-lob http://channel9.msdn.com/Tags/sdl-lob Channel 9 keeps you up to date with the latest news and behind the scenes info from Microsoft that developers love to keep up with. From LINQ to SilverLight – Watch videos and hear about all the cool technologies coming and the people behind them. http://channel9.msdn.com/Tags/sdl-lob en Thu, 23 May 2013 23:26:58 GMT Thu, 23 May 2013 23:26:58 GMT Rev9 8 1 25 Technical Preview for CAT.NET 2.0 Microsoft Information Security, talk about the newly designed version of CAT.NET which will be part of the Assessment & Protection (A&P) suite.

CAT.NET is a static analysis tool on Visual Studio that helps find vulnerabilities like SQL Injection, CSRF, XSS among others, within managed code. This version is currently a technical preview which works on the command line only though for its release it will be integrated with Visual Studio's UI under the Code Analysis tab. In this interview you can learn all the new features as well as details on how to provide feedback on the tool.

The CTP (Community Technology Preview) for this tool is available in Microsoft Connect – Information Security Tools.

Learn more about this tool by reading examples on how to run it by following the Security Tools Team blog. ]]> http://channel9.msdn.com/Blogs/Jossie/Technical-Preview-for-CATNET-20 Maqbool Malik and Anil Revuru (RV), from Microsoft Information Security, talk about the newly designed version of CAT.NET which will be part of the Assessment & Protection (A&P) suite.CAT.NET is a static analysis tool on Visual Studio that helps find vulnerabilities like SQL Injection, CSRF, XSS among others, within managed code. This version is currently a technical preview which works on the command line only though for its release it will be integrated with Visual Studio's UI under the Code Analysis tab. In this interview you can learn all the new features as well as details on how to provide feedback on the tool.The CTP (Community Technology Preview) for this tool is available in Microsoft Connect – Information Security Tools. Learn more about this tool by reading examples on how to run it by following the Security Tools Team blog. 1221 http://channel9.msdn.com/Blogs/Jossie/Technical-Preview-for-CATNET-20 Fri, 11 Dec 2009 19:32:00 GMT http://channel9.msdn.com/Blogs/Jossie/Technical-Preview-for-CATNET-20 Jossie Jossie 0 http://channel9.msdn.com/Blogs/Jossie/Technical-Preview-for-CATNET-20/RSS cat.net Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security Tools SDL-LOB Phase 3: Implementation The third phase of the SDL-LOB (Security Development Lifecycle for Line-of-Business applications) includes Implementation.

Eugene Siu, from Microsoft Information Security, describes some of the security pillars that are key in this phase, including code review, authentication, authorization and configuration settings. Also, he explains how penetration testing can complement your code review when bulletproofing your code against vulnerabilities.

Read more on the Implementation Phase here.
]]> http://channel9.msdn.com/Blogs/Jossie/SDL-LOB-Phase-3-Implementation The third phase of the SDL-LOB (Security Development Lifecycle for Line-of-Business applications) includes Implementation. Eugene Siu, from Microsoft Information Security, describes some of the security pillars that are key in this phase, including code review, authentication, authorization and configuration settings. Also, he explains how penetration testing can complement your code review when bulletproofing your code against vulnerabilities. Read more on the Implementation Phase here. 1099 http://channel9.msdn.com/Blogs/Jossie/SDL-LOB-Phase-3-Implementation Mon, 20 Jul 2009 17:54:00 GMT http://channel9.msdn.com/Blogs/Jossie/SDL-LOB-Phase-3-Implementation Jossie Jossie 2 http://channel9.msdn.com/Blogs/Jossie/SDL-LOB-Phase-3-Implementation/RSS ace ace team Development Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security Anti-XSS 3.0 Released Vineet Batta and Anil Revuru (RV), from Microsoft Information Security, talk about the release of the new version of the Anti-XSS library, which is designed to encode output to help developers protect their ASP.NET web-based applications from cross-site scripting attacks.

They explain the new features and benefits found on version 3.0, including:

  • Extended white list
  • Better performance
  • MSDN Style Help documentation
  • Marked Anti-XSS Output
  • Security Runtime Engine (SRE)

To learn more about this library read the following blogs from the Security Tools Team blog and previous posts.

]]> http://channel9.msdn.com/Blogs/Jossie/Anti-XSS-30-Released Vineet Batta and Anil Revuru (RV), from Microsoft Information Security, talk about the release of the new version of the Anti-XSS library, which is designed to encode output to help developers protect their ASP.NET web-based applications from cross-site scripting attacks. They explain the new features and benefits found on version 3.0, including: Extended white list Better performance MSDN Style Help documentation Marked Anti-XSS Output Security Runtime Engine (SRE) To learn more about this library read the following blogs from the Security Tools Team blog and previous posts. 1055 http://channel9.msdn.com/Blogs/Jossie/Anti-XSS-30-Released Wed, 15 Jul 2009 16:12:00 GMT http://channel9.msdn.com/Blogs/Jossie/Anti-XSS-30-Released Jossie Jossie 0 http://channel9.msdn.com/Blogs/Jossie/Anti-XSS-30-Released/RSS ace ace team Antixss Information information security infosec ist LOB Simple DirectMedia Layer sdl-lob Security Tools Threat Modeling LOB Applications with TAM 3.0 Andrew Law, from Microsoft Information Security, walks us through the creation of a threat model for a line-of-business application using the Threat Analysis & Modeling tool version 3.0. This screencast includes the definition and purpose of a threat model as well as its alignment with the SDL-LOB.

Threat Model ownership is discussed as well as the use of the central repository, common task list and how to leverage them to automatically generate threats.

Learn more on the Threat Modeling site & Information Security Tools blog.

]]> http://channel9.msdn.com/Blogs/Jossie/Threat-Modeling-LOB-Applications-with-TAM-30 Andrew Law, from Microsoft Information Security, walks us through the creation of a threat model for a line-of-business application using the Threat Analysis & Modeling tool version 3.0. This screencast includes the definition and purpose of a threat model as well as its alignment with the SDL-LOB. Threat Model ownership is discussed as well as the use of the central repository, common task list and how to leverage them to automatically generate threats. Learn more on the Threat Modeling site & Information Security Tools blog. 2925 http://channel9.msdn.com/Blogs/Jossie/Threat-Modeling-LOB-Applications-with-TAM-30 Mon, 06 Jul 2009 22:38:00 GMT http://channel9.msdn.com/Blogs/Jossie/Threat-Modeling-LOB-Applications-with-TAM-30 Jossie Jossie 0 http://channel9.msdn.com/Blogs/Jossie/Threat-Modeling-LOB-Applications-with-TAM-30/RSS ace ace team Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security tam threat modeling Tools SQL Detect
Maqbool Malik, from Microsoft Information Security, describes how this is one of the tools to be included in the to-be-released Security Runtime Engine (SRE).

To learn more about their tools, read the Information Security Tools blog.

]]> http://channel9.msdn.com/Blogs/Jossie/SQL-Detect SQL Detect is a SQL injection filter in real-time mode. When a request happens in the application the tool applies different heuristics to the data and tries to identify the attack. After the request is validated it proceeds. Maqbool Malik, from Microsoft Information Security, describes how this is one of the tools to be included in the to-be-released Security Runtime Engine (SRE). To learn more about their tools, read the Information Security Tools blog. 734 http://channel9.msdn.com/Blogs/Jossie/SQL-Detect Mon, 06 Jul 2009 19:41:00 GMT http://channel9.msdn.com/Blogs/Jossie/SQL-Detect Jossie Jossie 2 http://channel9.msdn.com/Blogs/Jossie/SQL-Detect/RSS ace ace team Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security sre Tools Architecture Behind CAT.NET Ben Livshits, from Microsoft Research, talks about the architecture behind CAT.NET, which is a static analysis tool on Visual Studio that helps find vulnerabilities like SQL Injection, CSRF,  XSS among others, within managed code.

Ben’s knowledge on static and dynamic dataflow analysis made him a key contributor on the creation of CAT.NET. He walks us through different examples of how the data analysis happens depending on complexity and explains how precision varies.

Learn more about Microsoft Information Security Tools. 

www.msinfosec.com 

]]> http://channel9.msdn.com/Blogs/Jossie/Architecture-behind-CATNET Ben Livshits, from Microsoft Research, talks about the architecture behind CAT.NET, which is a static analysis tool on Visual Studio that helps find vulnerabilities like SQL Injection, CSRF,  XSS among others, within managed code. Ben’s knowledge on static and dynamic dataflow analysis made him a key contributor on the creation of CAT.NET. He walks us through different examples of how the data analysis happens depending on complexity and explains how precision varies. Learn more about Microsoft Information Security Tools.  www.msinfosec.com  1067 http://channel9.msdn.com/Blogs/Jossie/Architecture-behind-CATNET Mon, 29 Jun 2009 22:24:00 GMT http://channel9.msdn.com/Blogs/Jossie/Architecture-behind-CATNET Jossie Jossie 1 http://channel9.msdn.com/Blogs/Jossie/Architecture-behind-CATNET/RSS ace ace team cat.net Information information security infosec LOB RiSE Simple DirectMedia Layer sdl-lob Security Tools Threat Analysis & Modeling Tool - TAM 3.0 Information Security Tools, provides an overview of the new version of TAM (Threat Analysis & Modeling), an asset-centric tool which uses an objective methodology to analyze applications for threats and define mitigation plans for them. TAM aligns to the SDL-LOB as part of the Design phase.

RV describes the new features in this version, including the online repository for the attack countermeasures, automated use cases creation, composite threats, among others.

Learn more:
  1. Microsoft Information Security
  2. TAM Tool Site 
]]> http://channel9.msdn.com/Blogs/Jossie/Thread-Analysis--Modeling-Tool-TAM-30 Anil Revuru (RV), from Information Security Tools, provides an overview of the new version of TAM (Threat Analysis & Modeling), an asset-centric tool which uses an objective methodology to analyze applications for threats and define mitigation plans for them. TAM aligns to the SDL-LOB as part of the Design phase. RV describes the new features in this version, including the online repository for the attack countermeasures, automated use cases creation, composite threats, among others. Learn more: Microsoft Information Security TAM Tool Site  961 http://channel9.msdn.com/Blogs/Jossie/Thread-Analysis--Modeling-Tool-TAM-30 Mon, 29 Jun 2009 20:43:00 GMT http://channel9.msdn.com/Blogs/Jossie/Thread-Analysis--Modeling-Tool-TAM-30 Jossie Jossie 2 http://channel9.msdn.com/Blogs/Jossie/Thread-Analysis--Modeling-Tool-TAM-30/RSS ace ace team Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security tam threat modeling Tools Security Design Reviews baked into the application all the way from design.

Anmol Malhotra, from Microsoft Information Security, provides more than enough reasons why Security Design Reviews make sense and why they are so important...let him walk you through the SDLC phases and how security tasks are found in each step.

To learn more about security on line-of-business applications using the SDL-LOB go here. ]]> http://channel9.msdn.com/Blogs/Jossie/Security-Design-Reviews Security is not something we just add at the end of the implementation phase...it should be baked into the application all the way from design. Anmol Malhotra, from Microsoft Information Security, provides more than enough reasons why Security Design Reviews make sense and why they are so important...let him walk you through the SDLC phases and how security tasks are found in each step. To learn more about security on line-of-business applications using the SDL-LOB go here. 1083 http://channel9.msdn.com/Blogs/Jossie/Security-Design-Reviews Wed, 24 Jun 2009 16:07:00 GMT http://channel9.msdn.com/Blogs/Jossie/Security-Design-Reviews Jossie Jossie 2 http://channel9.msdn.com/Blogs/Jossie/Security-Design-Reviews/RSS ace ace team Information information security infosec LOB Simple DirectMedia Layer sdl-lob Security