Life In the Digital Crosshairs

‘Local’ context can access WINRT X ‘Web’ context cannot access WINRT More capabilities, greater risk

Code fixes performed after release can cost up to 30 times more than fixes performed during the design phase.* Release Source: National Institute of Standards and Technology * Source: Aberdeen Group Security and Software Development Lifecycle ? !!

Code Analysis /DYNAMICBASE Address Space Layout Randomization (ASLR) /NXCOMPAT Data Execution Prevention (DEP) /GS Buffer Security Check Flag Banned API

? There are many inputs to store web apps to keep in mind.

 Understanding SAL (source code annotation language)   Analyzing Application Quality by Using Code Analysis Tools   Visual Studio 2013 Static Code Analysis in depth: What? When and how?  code-analysis-in-depth-what-when-and-how.aspx

 SDL Portal   SDL Blog   Simplified Implementation of the Microsoft SDL   Forrester Consulting Report “State of Application Security”   Aberdeen Group Report “Security and the Software Development Lifecycle: Secure at the Source” 