Security Development Lifecycle

Chapter 7. Stage 2: Define and Follow Design Best Practices

In this chapter:

Common Secure-Design Principles

Attack Surface Analysis and Attack Surface Reduction

The software industry abounds with security software coding best practices (few of which are followed), but there is a dearth of pragmatic secure-design guidance. Microsoft has spent considerable time working to make secure design accessible to the average non-security expert. Saltzer and Schroeder’s classic paper “The Protection of Information in Computer Systems” (Saltzer and Schroeder 1975, Computer Security Resource Center 2002) offers many time-tested secure-design principles that apply today as much as they did in 1975. Secure design is necessary for all computer software, from operating ...