Microsoft Security Development Lifecycle

Last updated

The Microsoft Security Development Lifecycle (SDL) is the approach Microsoft uses to integrate security into DevOps processes (sometimes called a DevSecOps approach). You can use this SDL guidance and documentation to adapt this approach and practices to your organization.  

Contents

The practices outlined in the SDL approach are applicable to all types of software development and across all platforms, ranging from traditional waterfall methodologies to modern DevOps approaches. They can generally be applied to the following:

The SDL recommends 10 security practices to incorporate into your development workflows. Applying the 10 security practices of SDL is an ongoing process of improvement so a key recommendation is to begin from some point and keep enhancing as you proceed. This continuous process involves changes to culture, strategy, processes, and technical controls as you embed security skills and practices into DevOps workflows.

The 10 SDL practices are:

  1. Establish security standards, metrics, and governance
  2. Require use of proven security features, languages, and frameworks
  3. Perform security design review and threat modeling
  4. Define and use cryptography standards
  5. Secure the software supply chain
  6. Secure the engineering environment
  7. Perform security testing
  8. Ensure operational platform security
  9. Implement security monitoring and response
  10. Provide security training

Versions

VersionRelease dateLink
1January 2004Unreleased
2July 2004Unreleased
2.1January 2005Unreleased
2.2July 2005Unreleased
3January 2006Unreleased
3.22008-04-15 http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24308
4.12009-06-01 http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=15526
4.1a2010-04-15 http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17701
52010-05-11 http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285
5.22012-05-23 http://www.microsoft.com/en-us/download/details.aspx?id=29884
62024-05-21 https://www.microsoft.com/securityengineering/sdl

See also

Further reading

  1. Establish culture, strategy and processes - Innovation security (CAF Secure)
  2. Define Security Practices and Controls - DevSecOps controls
  3. Assess your current workloads with the well architected security assessment - Well Architected Review


This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.