Desmond File

Blog archive

Secure Your Code

Microsoft technical fellow Michael Howard has probably forgotten more about secure software development than you or I will ever know. During a recent interview, the man behind Microsoft's strategic Security Development Lifecycle (SDL) program and the co-author of the book Writing Secure Code told me that young programmers entering the industry are simply not being trained about security issues.

"Really good software engineering skills are in incredibly short supply. We see that when we hire engineers out of school. They know nothing about building secure software," Howard told me. "They don't know the issues -- it's as simple as that. They don't understand the issues."

This is a lament I've heard before, and one that extends forward to deep concerns about the general state of corporate software development. Internal development shops are simply not doing enough to harden their code, particularly in an era when attacks are increasingly moving to the application layer.

Howard points a finger at universities that fail to integrate security concepts into their computer science curricula. He also singles out corporate development shops for failing to address secure development concepts, both from a training and operational standpoint. And that's not the worst of it, says Howard.

"You know, the most dangerous thing is the number of people who think they know how to build secure software, when they don't. That's the scary thing," he said.

Is Michael Howard on to something? Tell us what your company is doing to secure code against attacks and vulnerabilities, and how flawed development might have helped create a crisis in the past. Write me at [email protected].

Posted by Michael Desmond on 04/25/2007 at 1:15 PM

comments powered by Disqus


  • Top 3 Blazor Extensions for Visual Studio Code

    Some developers prefer to create applications with Microsoft's open-source Blazor tooling from within the open-source, cross-platform Visual Studio Code editor. Here are the top tools in the VS Code Marketplace for those folk, as measured by the number of installations.

  • How to Invert a Machine Learning Matrix Using C#

    VSM Senior Technical Editor Dr. James McCaffrey, of Microsoft Research, explains why inverting a matrix -- one of the more common tasks in data science and machine learning -- is difficult and presents code that you can use as-is, or as a starting point for custom matrix inversion scenarios.

  • Microsoft Engineer: 'It's Time to Move OData to .NET 5'

    Microsoft engineer Sam Xu says "it’s time to move OData to .NET 5" and in a new blog post he shows how to do just that.

  • Microsoft Goes Virtual with Developer Education in Face of COVID-19

    Like many organizations that host developer educational events, Microsoft has gone virtual amid shelter-in-place directives and a surge in remote work stemming from the COVID-19 pandemic.

  • Microsoft Enhances Low-Code Power Apps

    Microsoft's nod to the low-code movement, Power Apps, has been enhanced with a bevy of new features, including mixed reality, canvas/model support in a new mobile app, UX improvements and more.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events