Microsoft Security Research Articles

CHANGING SECURITY WITH EVERY SPIRAL

The Microsoft SDL integrates security and privacy considerations at every stage of development, assisting programmers in creating highly secure software while also addressing security compliance needs and lowering development costs (“[1]”). The software model: Spiral is crucial to this lifecycle's perspective. Microsoft has proposed the Microsoft Security Development Lifecycle (Microsoft SDL), a software development method based on the spiral model, to assist developers in producing software or applications while lowering security concerns, addressing security flaws, and even lowering development and maintenance costs. Training, requirements gathering, design, implementation, testing, deployment, and reviews are the seven phases that make up the process which is further explained in twelve different methodologies of the lifecycle model created by them. KEYWORDS: Microsoft, Software Engineering, Spiral Mode.

Randomized Controlled Trial for Microsoft Security Copilot

Randomized Controlled Trial for Microsoft Security Copilot

The Hardware Security Behind Azure Sphere

Traditional MCUs are price sensitive devices ill-prepared for the security challenges of internet connectivity. Azure Sphere MCUs are a new cross-over class of MCU with built-in Microsoft security technology, connectivity, and headroom to support dynamic new experiences. The MediaTek MT3620 combines ARM Cortex-A processor performance with real-time guarantees of an ARM Cortex-M class processor. It incorporates the Microsoft Pluton Security Subsystem to create a hardware root of trust, store private keys, and execute complex cryptographic operations. The MCU has built-in network connectivity to provide secure access to the cloud and the Azure Sphere Security Service. Azure Sphere OS is a secured OS that creates a trustworthy platform. It incorporates a custom Linux kernel, secured application containers, and security monitoring. The combination of the Pluton security hardware, Azure Sphere OS, and Azure Sphere Security Service provide certificate-based communications authentication, device and software authentication, device and application operation visibility, and secure updates.

Marketing @ Microsoft: The Value of Customer Perception

Quantifying the efficacy of marketing is an age-old challenge. As John Wanamaker said a century ago, “Half the money I spend on advertising is wasted; the trouble is I don't know which half.” The big difference today, however, is that the Internet enables detailed tracking of marketing campaigns in real time, or near time. Exemplifies how to leverage the Internet to dramatically improve the efficacy of marketing. Centers upon the Microsoft Security Guidance marketing campaign, which was designed to change IT professionals' perception of Microsoft's software product security. The integrated marketing campaign involved print media, analyst relations, and online advertising. The advertising was designed to drive IT professionals to a Web site on security guidance, then sign them up for free in-person security training classes. Illustrates two important best practices for marketing in the Internet age: first, the campaign was designed to be measured, and second, agility was specifically designed into the campaign. In addition to tracking weekly click-through data from the print and online advertising, the campaign also used online pop-up customer perception surveys. Analyzing the click-though data, Microsoft realized it had a problem at the end of the first week of the campaign–there were far fewer signups for the training sessions than anticipated. By the end of the second week the campaign was changed, resulting in a huge improvement in efficacy. Creates a scorecard illustrating the pros and cons of the Microsoft approach compared to a more traditional campaign. Illustrates how, rather than creating big-bang campaigns, high-performing marketing organizations today are continually experimenting. They build flexibility into campaigns and design them to be measured.To learn how to leverage the Internet in marketing campaigns, analyze click-through data and online survey results acquired in near time, and learn how it is used to fine tune and dramatically improve a campaign. Furthermore, illustrates how nonfinancial metrics can be used to quantify marketing efficacy.

A risk-centric defensive architecture for threat modeling in e-government application

To improve the security of an e-government, software engineering plays a vital role. During the application development for an e-government, there exist several risks. To analyse those risks, threat modelling methodology which is defined as the process to understand and address the threats of an application. Threat modelling is used to determine security controls and countermeasures for the targeting attacks. This paper describes an approach to identify how far the attack penetrates in risk layers and how the model defends from an attacker in e-government systems. The relevant attacks are retrieved from the attack pattern information is gathered from MITRE's common attack pattern enumeration and classification (CAPEC) security source. This architecture dynamically identifies the risk severity and prioritises the risk in a single step. An attack pattern applied to a risk-centric defensive architecture model to identify threat severity and also it is prioritised based on its impact. We validate risk-centric defensive architecture model by implementing it in a tool based on data flow diagrams (DFDs), from the Microsoft security development methodology.

A Comparative Analysis of University Information Systems within the Scope of the Information Security Risks

Universities are the leading institutions that are the sources of educated human population who both produce information and ensure to develop new products and new services by using information effectively, and who are needed in every area. Therefore, universities are expected to be institutions where information and information management are used efficiently. In the present study, the topics such as infrastructure, operation, application, information, policy and human-based information security at universities were examined within the scope of the information security standards which are highly required and intended to be available at each university today, and then a comparative analysis was conducted specific to Turkey. Within the present study, the Microsoft Security Assessment Tool developed by Microsoft was used as the risk analysis tool. The analyses aim to enable the universities to compare their information systems with the information systems of other universities within the scope of the information security awareness, and to make suggestions in this regard.

ASP.NET Websites Longitudinal Security Theoretical System

With the development of Internet technology, ASP.NET has been the most widely used Web platform. The invasion and attack of ASP.NETs sites bring Websites developed by ASP.NET facing a severe trial. With the constant expansion of the site, the Microsoft security features were not enough. This paper will summed up the knowledge and experience of ASP.NET website security development based on the Web security theory. In this paper, the strategy of the longitudinal analysis, platform security, data security, Web application security, WCF security, website front-end security and other important aspects will be analyzed. By constructing a relatively complete theoretical of ASP.NET security, intelligence e-business web site Kooboo eCommerce become much more secure.

Automating risk analysis of software design models.

The growth of the internet and networked systems has exposed software to an increased amount of security threats. One of the responses from software developers to these threats is the introduction of security activities in the software development lifecycle. This paper describes an approach to reduce the need for costly human expertise to perform risk analysis in software, which is common in secure development methodologies, by automating threat modeling. Reducing the dependency on security experts aims at reducing the cost of secure development by allowing non-security-aware developers to apply secure development with little to no additional cost, making secure development more accessible. To automate threat modeling two data structures are introduced, identification trees and mitigation trees, to identify threats in software designs and advise mitigation techniques, while taking into account specification requirements and cost concerns. These are the components of our model for automated threat modeling, AutSEC. We validated AutSEC by implementing it in a tool based on data flow diagrams, from the Microsoft security development methodology, and applying it to VOMS, a grid middleware component, to evaluate our model's performance.

Using network-based text analysis to analyze trends in Microsoft's security innovations

As the use of networked computers and digital data increase, so have the reports of data compromise and malicious cyber-attacks. Increased use and reliance on technologies complicate the process of providing information security. This expanding complexity in supplying data security requirements coupled with the increased recognition of the value of information, have led to the need to quickly advance the information security area. In this paper, we examine the maturation of the information security area by analyzing the innovation activity of one of the largest and most ubiquitous information technology companies, Microsoft. We conduct a textual analysis of their patent application activity in the information security domain since the early 2000's using a novel text analysis approach based on concepts from social network analysis and algorithmic classification. We map our analysis to focal areas in information security and examine it against Microsoft's own history, in order to determine the depth and breadth of Microsoft's innovations. Our analysis shows the relevance of using a network-based text analysis. Specifically, we find that Microsoft has increasingly emphasized topics that fall into the identity and access management area. We also show that Microsoft's innovations in information security showed tremendous growth after their Trustworthy Computing Initiative was announced. In addition, we are able to determine areas of focus that correspond to Microsoft's major vulnerabilities. These findings indicate that while Microsoft is still actively, albeit not always successfully, fighting vulnerabilities in their products, they are quite vigorously and broadly innovating in the information security area.

Features of Virus Detection Mechanism in Microsoft Security Essentials (Microsoft Forefront Endpoint Protection)

In this paper, a signature-based selective mechanism in detecting virus signatures in executable files was found and investigated. A pattern under which the Microsoft Security Essentials antivirus software not detecting a virus signature deliberately placed in files was revealed.

Deconstructing Flame: the limitations of traditional defences

The Flame Virus will go down in history as the most complex, most sophisticated and largest cyber-espionage tool to fool Microsoft's Terminal Services licensing certificate authority. Using a detailed yet brilliant (in terms of cybercrime) strategy, Flame infiltrated thousands of computers in the Middle East by capitalising on a flaw that allowed attackers to create a digital security certificate masquerading as an official Microsoft security certificate. What's more, it came in the form of a Microsoft update. Although it looked genuine, users allowing the update were giving Flame the go-ahead to install massive amounts of spyware and code on their machines. The Flame Virus will go down in history as one of the largest and most complex cyber-espionage tools. Using a detailed yet brilliant (in terms of cybercrime) strategy, Flame infiltrated thousands of computers in the Middle East by forging an official Microsoft security certificate. Traditional anti-virus software is sadly ineffective against such sophisticated attacks. Organisations need to move to a whitelisting model if they want to stand any chance of beating off the attacks of the future, argues Kate Munro of Bit9.

Improving Software Security by Eliminating the CWE Top 25 Vulnerabilities

CWE, which stands for Common Weakness Enumeration, is a project sponsored by the National Cyber Security Division of the US Department of Homeland Security to classify security bugs. It assigns a unique number to weakness types such as buffer overruns or cross-site scripting bugs (for example, CWE- 327 is Use of a Broken or Risky Cryptographic Algorithm). Shortly after the Top 25 list's release, Microsoft unveiled a document entitled, The Microsoft SDL and the CWE/SANS Top 25, to explain how Microsoft's security processes can help prevent the worst offenders (http://blogs.msdn.com/sdl/ archive/2009/01/27/sdl-and-the -cwe-sans-top-25. aspx).

Silver Bullet Talks with Adam Shostack

Gary McGraw interviews Adam Shostack. Shostack is a member of Microsoft's Secure Development Lifecycle Team. He's worked for Zero Knowledge as Most Evil Genius and Reflective where, as CTO, he focused on static analysis for software security. Shostack recently coauthored The New School of Information Security with Andrew Stewart.

Microsoft security to spill over to hardware

Microsoft security to spill over to hardware

Vulnerability in Microsoft RTF files

Microsoft Security Bulletin MS00-005 reveals that there is a denial-of-service vulnerability where specially crafted data is used to exploit this vulnerability. RTF files consist of text and control information. The control information is specified via directives called control words. The default RTF reader that ships as part of many Windows platforms has an unchecked buffer in the portion of the reader that parses control words. If an RTF file contains a specially malformed control word it could cause the application to crash.