Template Guides Development of Secure Code

The free Security Development Lifecycle (SDL) Process Template for Visual Studio Team System (VSTS), which became available in May 2009, could help development teams use the same practices Microsoft uses internally to minimize security vulnerabilities in software. The template can be applied to a VSTS project to add security-related objects, such as work items, guidance documents, check-in policies, and reports, into the VSTS development environment. However, the template does not leverage new functionality in VSTS 2010, which will probably arrive in the first half of 2010.

Reducing Application Vulnerabilities

SDL is a mandatory set of practices Microsoft uses during software development to minimize security vulnerabilities in its products. They include the following:

• Developing threat models early in the process to ensure the product team mitigates the threats in design, coding, and testing
• Using code-scanning tools during development and testing to help find commonly exploited