Sorry, this item is not available in
Image not available for
Image not available

To view this video download Flash Player

Sell Us Your Item
For a $3.77 Gift Card
Trade in
Have one to sell? Sell yours here
Tell the Publisher!
I'd like to read this book on Kindle

Don't have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

The Security Development Lifecycle: SDL: A Process for Developing Demonstrably More Secure Software [Paperback]

by Michael Howard, Steve Lipner
4.6 out of 5 stars  See all reviews (5 customer reviews)

Available from these sellers.

Free Two-Day Shipping for College Students with Amazon Student


Amazon Price New from Used from
Kindle Edition --  
Paperback --  
Unknown Binding --  
Sell Us Your Books
Get up to 80% back when you sell us your books, even if you didn't buy them at Amazon. Learn more

Book Description

June 28, 2006 0735622140 978-0735622142 1

Your customers demand and deserve better security and privacy in their software. This book is the first to detail a rigorous, proven methodology that measurably minimizes security bugs—the Security Development Lifecycle (SDL). In this long-awaited book, security experts Michael Howard and Steve Lipner from the Microsoft Security Engineering Team guide you through each stage of the SDL—from education and design to testing and post-release. You get their first-hand insights, best practices, a practical history of the SDL, and lessons to help you implement the SDL in any development organization.

Discover how to:

  • Use a streamlined risk-analysis process to find security design issues before code is committed
  • Apply secure-coding best practices and a proven testing process
  • Conduct a final security review before a product ships
  • Arm customers with prescriptive guidance to configure and deploy your product more securely
  • Establish a plan to respond to new security vulnerabilities
  • Integrate security discipline into agile methods and processes, such as Extreme Programming and Scrum

Includes a CD featuring:

  • A six-part security class video conducted by the authors and other Microsoft security experts
  • Sample SDL documents and fuzz testing tool

PLUS—Get book updates on the Web.

A Note Regarding the CD or DVD

The print version of this book ships with a CD or DVD. For those customers purchasing one of the digital formats in which this book is available, we are pleased to offer the CD/DVD content as a free download via O'Reilly Media's Digital Distribution services. To download this content, please visit O'Reilly's web site, search for the title of this book to find its catalog page, and click on the link below the cover image (Examples, Companion Content, or Practice Files). Note that while we provide as much of the media content as we are able via free download, we are sometimes limited by licensing restrictions. Please direct any questions or concerns to

Special Offers and Product Promotions

Editorial Reviews

From the Publisher

The software industry is clamoring to learn more about the SDL methodology. With insights direct from Microsoft’s security team, where these techniques have been developed and proven to help reduce code defects, this book premieres SDL to a worldwide audience and is the first to detail the methodology stage by stage.

Key Book Benefits:

• Delivers practical, proven advice from the experts for minimizing security-related code defects

• Details a methodology that can be applied to any development process, with outstanding results

• Includes a CD-ROM with video training classes for developers conducted by coauthor Michael Howard, a security program manager at Microsoft

About the Author

Michael Howard, CISSP, is a leading security expert. He is a senior security program manager at Microsoft® and the coauthor of The Software Security Development Lifecycle. Michael has worked on Windows security since 1992 and now focuses on secure design, programming, and testing techniques. He is the consulting editor for the Secure Software Development Series of books by Microsoft Press.

Steve Lipner, CISSP, is the senior director of Security Engineering Strategy for Microsoft. He is responsible for defining and updating the Security Development Lifecycle and has pioneered numerous security techniques. Steve has over 35 years’ experience as a researcher, development manager, and general manager in IT security.

Product Details

  • Paperback: 352 pages
  • Publisher: Microsoft Press; 1 edition (June 28, 2006)
  • Language: English
  • ISBN-10: 0735622140
  • ISBN-13: 978-0735622142
  • Product Dimensions: 8.9 x 7.7 x 1.1 inches
  • Shipping Weight: 1.5 pounds
  • Average Customer Review: 4.6 out of 5 stars  See all reviews (5 customer reviews)
  • Amazon Best Sellers Rank: #382,123 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews
16 of 16 people found the following review helpful
I read six books on software security recently, namely "Writing Secure Code, 2nd Ed" by Michael Howard and David LeBlanc; "19 Deadly Sins of Software Security" by Michael Howard, David LeBlanc, and John Viega; "Software Security" by Gary McGraw; "The Security Development Lifecycle" by Michael Howard and Steve Lipner; "High-Assurance Design" by Cliff Berg; and "Security Patterns" by Markus Schumacher, et al. Each book takes a different approach to the software security problem, although the first two focus on coding bugs and flaws; the second two examine development processes; and the last two discuss practices or patterns for improved design and implementation. My favorite of the six is Gary McGraw's, thanks to his clear thinking and logical analysis. The other five are still noteworthy books. All six will contribute to the production of more security software.

"Security Development Lifecycle" (SDL) is unique because in many ways it exposes the guts of Microsoft's product development process. I cannot recall seeing another technical company share so much of its internal procedures with the public. One of the most interesting aspects of SDL is the attention paid to security after a product is shipped. No one at Microsoft breathes a sigh of relief when boxes appear on store shelves. Instead, Microsoft explains how it conducts security response planning in ch 15 and security response execution in ch 17. (Between the two is ch 16 -- only 3/4 of a page! Why bother?)

Although I liked SDL overall (enough to justify 4 stars), I thought it suffered three major problems. First, I don't think the audience was defined properly. p xviii mentions "managers" as the primary target, along with architects and designers. Specifically, "this is not a book for developers.
Read more ›
Comment | 
Was this review helpful to you?
9 of 9 people found the following review helpful
4.0 out of 5 stars Good, but not great September 8, 2006
I have been very impressed with other offerings from the Microsoft professional series and was excited when this book was released. This is not a technical book like "Writing Secure Code" and "Code Complete" but a book aimed at managers responsible for software projects. My opinion is not based on real world experience of large software projects, but on academic projects smaller in scale than those of Microsoft.

The introductory material is weak, part 1 which explores the reasoning and history behind the SLD seemed to be stretched needlessly, repeating the same information multiple times. Chapter 4 which provides the management impact of the SDL lacks focus, and does not justify the need (ROI) for the SDL.

Part 2 goes though each step of the SDL in detail. Overall, this section is more polished and for the most part does a good job of covering each domain in detail. While this book is focused on managerial and operational activities, there are times where it awkwardly delves into specific technical details. Chapter 10 (Documents, Tools, Practices for customers) and chapter 15 (Response planning) are strong chapters which most everyone can lean from.

Part 3 is a series of reference materials. Chapter 20 (Crypto) and 21 (Compiler Options) are good guidelines to compare your organizations own practices against.
Read more ›
Comment | 
Was this review helpful to you?
5.0 out of 5 stars The definitive work on secure software March 20, 2013
Format:Kindle Edition|Verified Purchase
Well ten with many excellent examples.

This is the place to start if you're interested in developing secure software or reviewing systems for security and re3liability.
Comment | 
Was this review helpful to you?
1 of 2 people found the following review helpful
5.0 out of 5 stars Managerial View of the Microsoft Approach to Security September 26, 2006
As is well known, Microsoft software has been known in the past for producing software that had numerous problems in the security area. It finally became so obvious that the company was forced to make a major change in emphasis regarding the security holes in their products.

Microsoft is, of course, a huge software development organization. To move the organization into writing more secure code it was necessary to develop plans, procedures, classes for managers and programmer and the like to implement writing more secure code. The resulting effort is called the Security Development Lifecycle (SDL).

The results of implementing SDL are summarized in the Introduction to the book. Here are two newspaper headlines quoted there:

Gartner Recommends Against Microsoft IIS (eWeek, 2001)

We actually consider Microsoft to be leading the software industry now in improvements in their security development life cycle (CRN 2006)

This book is aimed at the people managing and defining software projects. It does not contain very many specific code examples that would appeal to the developer. This is not to say that developers shouldn't read it, but that it is not a detailed techie document.

The CD that comes with the book includes several documents that extend the concepts talked about in the book and a six part security class video conducted by the authors.

One note of caution. This book is on the Microsoft approach to security. It's what they are doing. It works for them. But there are also other approaches such as that being implemented by organizations such as the US Government.
Comment | 
Was this review helpful to you?
Most Recent Customer Reviews
Search Customer Reviews
Only search this product's reviews

What Other Items Do Customers Buy After Viewing This Item?


There are no discussions about this product yet.
Be the first to discuss this product with the community.
Start a new discussion
First post:
Prompts for sign-in

Look for Similar Items by Category