Appendix Q: SDL-Agile Bucket Requirements

Bucket A: Security Verification

TitleRequirement/RecommendationApplies to Online ServicesApplies to Managed CodeApplies to Native Code
Debug the application with the Application Verifier enabledRequirementX
Disable tracing and debugging in ASP.NET applicationsRequirementXX
Ensure regular expressions must not execute in exponential time (O(2^n))RequirementXXX
Ensure sample code complies with appropriate SDL development practicesRequirementXXX
Employ network fuzzingRequirementXX
Investigate and service any reported /GS crashesRequirementX
Perform ActiveX control fuzzingRequirementXX
Perform attack surface analysisRequirementXXX
Perform binary analysis (BinScope)RequirementXXX
Perform COM object testingRequirementX
Perform cross-domain scripting testingRequirementXXX
Perform file fuzz testingRequirementXX
Perform RPC fuzz testingRequirementXX
Conduct in-depth manual and automated code review for high-risk codeRecommendationXXX
Perform data flow testingRecommendationXXX
Perform input validation testingRecommendationXXX
Perform replay testingRecommendationXXX

Bucket B: Design Review

TitleRequirement/RecommendationApplies to Online ServicesApplies to Managed CodeApplies to Native Code
Avoid cross-domain access to authenticated sitesRequirementXXX
Comply with User Account Control (UAC) best practices to ensure all code runs as a non-administratorRequirementXX
Conduct a privacy reviewRequirementXXX
Ensure all code is compliant with the SDL Cryptographic StandardsRequirementXXX
Ensure all code is compliant with the SDL Privacy Guidelines documentRequirementXXX
Incorporate third-party component licensing security requirements in all new contractsRequirementXXX
Opt out of automatic MIME sniffingRequirementXX
Use strongly named assemblies, and request minimal permissionsRequirementXX
Apply no-open header to user-supplied downloadable filesRequirementXXX
Complete in-depth threat model trainingRecommendationXXX
Disable rarely used features by default, to reduce attack surfaceRecommendationXXX
Grant minimal privilegesRecommendationXXX
Review planning and design specifications for user interface elementsRecommendationXXX
Use Windows Imaging Component to process image dataRecommendationXXX

Bucket C: Planning

TitleRequirement/RecommendationApplies to Online ServicesApplies to Managed CodeApplies to Native Code
Add or update privacy scenarios in the test planRequirementXXX
Create or update the list of response contactsRequirementXXX
Define or update the privacy bug barRequirementXXX
Define or update the security bug barRequirementXXX
Ensure symbols are available internally for all public releasesRequirementXXX
Create or update a business continuity-disaster recovery planRecommendationXXX
Create or update a network down planRecommendationXXX
Create or update content publishing planRecommendationXXX
Create or update privacy support documentsRecommendationXXX

Content Disclaimer

This documentation is not an exhaustive reference on the SDL process as practiced at Microsoft. Additional assurance work may be performed by product teams (but not necessarily documented) at their discretion. As a result, this example should not be considered as the exact process that Microsoft follows to secure all products.

This documentation is provided “as-is.” Information and views expressed in this document, including URL and other Internet website references, may change without notice. You bear the risk of using it.

This documentation does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.

© 2012 Microsoft Corporation. All rights reserved.

Licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported