SecurityFeed.info » Michael Howard's Web Log

Feeds

28634 items (28634 unread) in 97 feeds

• Aviv Raff On .NET (22 unread)
• Bugtraq (bugtraq) Mailing List (697 unread)
• CGISecurity.com: Your Web Site and Application Security Resource (125 unread)
• christian's weblog (25 unread)
• Irongeek's Security Site (159 unread)
• Jeremiah Grossman (85 unread)
• Heorot.net (13 unread)
• milw0rm.com (520 unread)
• Nmap Hackers (nmap-hackers) Mailing List (9 unread)
• Packet Storm Security Advisories (440 unread)
• Packet Storm Security Exploits (541 unread)
• Packet Storm Security Headlines (450 unread)
• Packet Storm Security Last 100 (2496 unread)
• Packet Storm Security Last 20 (993 unread)
• Packet Storm Security Last 50 (1803 unread)
• Packet Storm Security Last Files (624 unread)
• Packet Storm Security Miscellaneous Files (162 unread)
• Packet Storm Security Tools (174 unread)
• Rootsecure.net (819 unread)
• SecuriTeam.com (262 unread)
• Security Vulnerability Research & Defense (47 unread)
• SecurityFocus News (173 unread)
• SecurityFocus Vulnerabilities (868 unread)
• Securityvulns news channel (407 unread)
• SecWatch - Latest Exploit Alerts (10 unread)
• Taking Network Security to the Streets (28 unread)
• The One And Only Matt Parnell.com (38 unread)
• The Register - Security (594 unread)
• The Register - Software (663 unread)
• VulnWatch (vulnwatch) Mailing List (19 unread)
• Web App Security (webappsec) Mailing List (118 unread)
• IceСμbeς (15 unread)
• Linmagazine (281 unread)
• ‫netcraft Bytes :) (47 unread)
• Digg (4381 unread)
• Blonde 2.0 (68 unread)
• The Microsoft Security Response Center (MSRC) (59 unread)
• (IN)SECURE Magazine Notifications RSS (18 unread)
• 0x000000 Security (95 unread)
• ----- Anti-Malware ----- Analysis and Defense (16 unread)
• Apple Fun (25 unread)
• Technorati Search for: aviv.raffon.net (263 unread)
• C.I.S.R.T. (10 unread)
• Determina Zero-Day Protection (6 unread)
• Didier Stevens (67 unread)
• eEye Digital Security - Research Blog (10 unread)
• Ryan Naraine's Security Watch (153 unread)
• Security - RSS Feeds (265 unread)
• Exploit Prevention Labs (28 unread)
• Software Vulnerability Exploitation Blog (22 unread)
• F-Secure Antivirus Research Weblog (109 unread)
• Full Disclosure (300 unread)
• George Ou (10 unread)
• GNUCITIZEN Media Portfolio (96 unread)
• ha.ckers.org web application security lab (43 unread)
• heise security (468 unread)
• invisiblethings' blog (35 unread)
• Jeff Jones's blog (12 unread)
• JScript Blog (18 unread)
• Matasano Chargen (43 unread)
• McAfee Avert Labs (89 unread)
• Michael Howard's Web Log (37 unread)
• PandaLabs (52 unread)
• Zero Day (333 unread)
• SANS Internet Storm Center, InfoCON: green (287 unread)
• Latest Secunia Security Watchdog Blog Entries (32 unread)
• SecuriTeam Blogs (85 unread)
• Security Fix (163 unread)
• HP ASC Portal (30 unread)
• Strike Center (12 unread)
• Sunbelt Blog (296 unread)
• Sunnet Beskerming Security Advisories (45 unread)
• Technobabylon
• The Recurity Lablog (33 unread)
• Wired: Threat Level (626 unread)
• TrendLabs | Malware Blog - by Trend Micro (213 unread)
• Uninformed Journal (49 unread)
• WabiSabiLabi's blog (23 unread)
• WatchGuard Wire (58 unread)
• Latest Blog Entires From WebSense Security Labs (67 unread)
• Hackszine.com (215 unread)
• DVLabs: Blogs (79 unread)
• Errata Security (90 unread)
• Robert Hensing's Blog (91 unread)
• PaulDotCom Community Blog (12 unread)
• David LeBlanc's Web Log (24 unread)
• Billy (BK) Rios (23 unread)
• David Litchfield's blog (21 unread)
• Farfromr00tin (23 unread)
• aut disce, aut discede (17 unread)
• pwn* (16 unread)
• hackademix.net (54 unread)
• SecurityDot Vulnerabilities (525 unread)
• Vulnerabilities & Exploits (37 unread)
• Malicious Code (33 unread)
• Security Risks (22 unread)
• Digg / Security / upcoming (4475 unread)

Michael Howard's Web Log (10 unread)

• November 03, 2008
• 16:16

  Volume 5 of the Microsoft Security Intelligence Report is out

   » ‎ Michael Howard's Web Log
  Volume 5 of the Microsoft Security Intelligence Report is now out, highlights include:

  • Security vulnerability disclosures - Microsoft and third-party software
  • Vulnerability Exploits – Microsoft software
  • Browser-based exploits - Microsoft and third-party software
  • Security and privacy breaches
  • Malicious and potentially unwanted software trends

  Volume 5 of the SIR also includes a detailed examination of the threat ecosystem which explains how threats propagate across the internet, how users become infected and the resultant impact on privacy and identity theft.

   

  The one item that stood out for me was the move from successfully attacking Microsoft applications and browser objects to attacking and compromising 3rd-party applictions and browser objects.

  
• October 28, 2008
• 21:38

  Security-Related MSDN Magazine Articles

   » ‎ Michael Howard's Web Log

  Bryan Sullivan and I wrote a couple of articles for this month's MSDN Magazine. If you're not aware, November focuses on Security.

  The two articles are:

  Test Your Security IQ

  Threat Models Improve Your Security Process

   

  And there's the Agile SDL paper than I already mentioned.

  
• 21:35

  Agile SDL

   » ‎ Michael Howard's Web Log
  Over the last year or so, a bunch of us in the SDL team have been working with agile groups across Microsoft to help streamline the SDL for agile methods. Bryan Sullivan wrote a paper for MSDN Magazine explaining where our current throughts lie. Clearly this is just the start, we have some more work to do, but we thought it would be worthwhile putting our ideas out there to get feedback and comments.
• October 08, 2008
• 20:04

  SAFECode releases "Fundamental Practices for Secure Software Development" document

   » ‎ Michael Howard's Web Log

  Today, SAFECode released an important document entitled, “Fundamental Practices for Secure Software Development” aimed at helping software producers create more secure software.

  The document is unique in that it describes what SAFECode members are doing in practice to raise the security bar; it’s not a theoretical or academic document.

  I believe the fact that it describes what’s used in practice is what makes the document important because it means the ideas in the document can be implemented in the real world regardless of the type of software under development.

  So take a look, and let me know what you think.
  

  Updated: first review from InfoWorld.

  
• September 26, 2008
• 22:50

  Practical Defense in Depth

   » ‎ Michael Howard's Web Log

  <sent from Cabo San Lucas Airport - heading back to Austin >

  Crosstalk has published an article for mine regarding how we use Defense in Depth within the SDL, and in Microsoft in general.

  
• September 17, 2008
• 21:16

  Twitter Feed

   » ‎ Michael Howard's Web Log

  I've been doing this Twitter thing for a while now - I really like it, folks can get a feel for what you're up to each day.

  If you're interested, you can see what I'm up to by clicking 'Follow' at [twitter.com]

  
• 7:02

  SDL Evolution

   » ‎ Michael Howard's Web Log

   UPDATED: Added IOActive post

  As many of you have seen today, there's been plenty of press about us opening up the SDL for use by other software developers and releasing our threat modeling tool. For those of you who have no clue what the heck I'm talking about, here are a handful of articles about what happened today:

  • Microsoft becomes high priest of secure software development (C|Net)
  • Microsoft looks to spread secure software expertise (Computerworld)
  • Microsoft to Share Its Secure Development Blueprint, Threat Modeling Tool (Dark Reading)

  I'm not sure about the "High Priest" moniker, but what the heck :)

  Cigital also blogged about the event, most notably the SDL Pro Network, and IOActive posted some comments too.

  I'm really excited to see the SDL move forward and most importantly, outward. We have learned a great deal about what it takes to make steps toward securing software. We don't expect perfection, but if more people embrace some of the principles we define in the SDL, and we have experienced and knowledgable partners scale the effort, I think the IT world will be a substantially more secure place.

  -Michael

  
• September 16, 2008
• 4:46

  James Whittaker has a blog

   » ‎ Michael Howard's Web Log

  SDL alumnus James Whittaker has a blog. I meant to write a note on this weeks ago, but I kinda got busy! Anyway, if you're a tester, or have a passing interest in test, James is one of the best and you should learn from him. He's the author or coauthor of How to Break Software, How to Break Software Security and How to Break Web Software.

  [blogs.msdn.com]

  
• September 15, 2008
• 17:18

  GOOG Chrome's use of NX/DEP

   » ‎ Michael Howard's Web Log

  Scott Hanselman has a look under Chrome's hood and how it uses the new NX/DEP APIs we added to Windows.

  Scroll about halfway down the article.

  
• 16:25

  Kim Cameron on GOOGs single sign on design vulnerability

   » ‎ Michael Howard's Web Log
  I spoke with Kim Cameron a few days ago about Google's single sign-on (SSO) design bug. I wanted his take on the bug because he's one of the best in the area of identity, single sign-on etc etc... his response can only be described as scathing.