A good move, but more is needed.
Microsoft is opening its internally crafted Security Development Lifecycle (SDL) to customers through a variety of new initiatives and is starting a program for third-party consultancies called SDL Pro Network "through which Microsoft customers will be able to learn the secure development processes that the company has created in the last four years for developer training, defining design objectives and implementation of best practices." [Fisher].
This is good.
Microsoft is certainly helping the entire software community by releasing this information and it will undoubtedly help some write better, safer, more secure software. But there remains the option of hundreds of thousands of developers and software manufacturers to abstain from leveraging this or other related information. This is true for two reasons:
1. Software manufacturers choose independently of all others to what depth and degree to pursue secure development practices.
2. Security is still not part of market competition.
As much as Microsoft should be applauded for its efforts (I clapped when I heard the news), it must be remembered that Microsoft did not start its security efforts in earnest until after the company had attained 90 percent of the desktop market and some 40 percent of the server market. This is a model that many software manufacturers still rabidly pursue and can pursue because the market does not "see" security until the absence is all too clear. Security is, and remains, a missing and invisible criterion in the market's beauty contest.
Microsoft is making a good move by releasing its program to others, but astute readers understand this does not alter current market incentives. Microsoft may be powerful, but alas it is not that powerful. The rush-to-the-mountaintop still means that software manufacturers who might be well-intentioned regarding security and who may adopt Microsoft's SDL guidance must compete with a majority of those that are free to avoid such a burden.
And that, is what needs to change.
Comments