Notes

Slide Show |

Outline

1 | Building Secure Software: The Global Mandate with Howard Schmidt October 2005
2 | Agenda The global mandate for secure software development The rise of Trustworthy Computing What will the future bring us?
3 | Speakers Howard A. Schmidt Global Security Expert CEO R&H Security Consulting, LLC Former security leader within Microsoft, eBay & US Government Jim Reavis, ISSA Advisory Board member, SPI Dynamics
4 | A massive threat: Insecure Software Cost of poor security in the US alone between $22.2B and $59.5 billion per year (NIST) Cost per patch applied: $900 per server, $700 per client - Economist “75 percent of hacks happen at the application” - Gartner “Security at the Application Level” “Over 70 percent of security vulnerabilities exist at the application layer, not the network layer” - Gartner “If only 50 percent of software vulnerabilities were removed prior to production … costs would be reduced by 75 percent” - Gartner “Security at the Application Level” “64 percent of developers are not confident in their ability to write secure applications” - Microsoft Developer Research
5 | The longer you wait, the more it costs
6 | Trustworthy Computing Launched by Microsoft in Jan 2002 Four Pillars Security, Privacy, Reliability in Software Integrity in Business Practices Unprecedented call to action Stand down on software development for nearly 2 months Major focus is secure software development
7 | Microsoft Today Internal & External focus to secure software development People Educational outreach Process SDL research Technology Compiler tools, libraries, bug tracking and much more
8 | Discussion Point How do you scale secure SDL programs through different sized organizations?
9 | Discussion Point Role of Government: Proscriptive, Punitive, Bully Pulpit?
10 | Discussion Point Metrics: Can we agree what needs to be measured and find the data?
11 | Discussion Point Manufacturer Liability versus Consumer Responsibility
12 | Discussion Point Procurement: Buying secure software and outsourcing development
13 | Discussion Point Quality Assurance, Testing, Audit
14 | Discussion Point Education Primary Ed & Universities Continuing Professional Education Education for non-coders?
15 | Discussion Point How do we get executive backing for secure software development?
16 | Summary Trustworthy Computing changed Microsoft in fundamental ways A People, Process, Tools approach to secure software development is key This approach must increasingly be embraced by all software developers outside of Microsoft as well