Georgeo Pulikkathara's Microsoft Blog https://docs.microsoft.com/archive/blogs/georgeop/feed.xml I'm the Microsoft Security Development Lifecycle (SDL) Product Management guy. Wed, 17 Apr 2019 03:20:55 GMT en-US hourly 1 Apple, Google and Others Agree to Provide Privacy Policy Option for Mobile Developers | threatpost https://docs.microsoft.com/archive/blogs/georgeop/apple-google-and-others-agree-to-provide-privacy-policy-option-for-mobile-developers-threatpost Fri, 24 Feb 2012 09:30:15 GMT https://blogs.msdn.microsoft.com/georgeop/2012/02/24/apple-google-and-others-agree-to-provide-privacy-policy-option-for-mobile-developers-threatpost/ I’m glad to see more companies working to improve privacy policies for mobile developers. Great quote from this article. "Your personal privacy should not be the cost of using mobile apps, but all too often it is….”California Attorney General Kamala Harris said.

Apple, Google and Others Agree to Provide Privacy Policy Option for Mobile Developers | threatpost

]]> Security Development Conference 2012 https://docs.microsoft.com/archive/blogs/georgeop/security-development-conference-2012 Mon, 20 Feb 2012 13:47:38 GMT https://blogs.msdn.microsoft.com/georgeop/2012/02/20/security-development-conference-2012/

Security Development Conference 2012  www.securitydevelopmentconference.com

Registration for the Security Development Conference is now LIVE! Early Bird Registration: $300

May 15-16, 2012 |Washington. D.C.

EVOLVING FROM PRINCIPLES TO PRACTICES

Industry and government decision makers are increasingly aware that operational security protections and regulatory compliance are insufficient in protecting global applications and infrastructures. Organizations are realizing the value of Security Development Lifecycle (SDL) practices and seek to accelerate adoption and articulate this value to management.

The inaugural Security Development Conference 2012 (SDC 2012) will bring together industry professionals to network and learn from security experts about Security Development Lifecycle (SDL) practices. SDC 2012 will include information for leaders in software engineering, process and business management who are responsible for accelerating the adoption and effectiveness of SDL practices in their organizations.

]]> Financial Services Industry Employs Microsoft SDL In New Secure Software Model - Dark Reading https://docs.microsoft.com/archive/blogs/georgeop/financial-services-industry-employs-microsoft-sdl-in-new-secure-software-model-dark-reading Wed, 01 Feb 2012 10:52:03 GMT https://blogs.msdn.microsoft.com/georgeop/2012/02/01/financial-services-industry-employs-microsoft-sdl-in-new-secure-software-model-dark-reading/ Financial Services Industry Employs Microsoft SDL In New Secure Software Model - Dark Reading

 

This is really nice to see. For those of you who are not familiar with BITS, BITS is the technical policy arm for the Financial Services Roundtable. The Financial Services Round Table mission is to protect and promote the economic vitality and integrity of its members and the United States financial system. I first learned about this organization, 21 years ago, when I was working at Cooper Industries in Houston Texas as a Network Administrator, managing an IBM Token Ring network. The fact that BITS is collaborating with Microsoft to use key SDL features is a good thing for the financial services industry. The BITS software assurance framework can help independent software vendors (ISVs) to write better, more secure software. Be sure to visit the BITS website to download and read more about the BITS whitepaper, Software Assurance Framework. I’d love to hear back on what folks think of the BITS software Assurance Framework.

George

]]> Slammed And Blasted A Decade Ago, Microsoft Got Serious About Security | threatpost https://docs.microsoft.com/archive/blogs/georgeop/slammed-and-blasted-a-decade-ago-microsoft-got-serious-about-security-threatpost Wed, 18 Jan 2012 13:14:15 GMT https://blogs.msdn.microsoft.com/georgeop/2012/01/18/slammed-and-blasted-a-decade-ago-microsoft-got-serious-about-security-threatpost/ Slammed And Blasted A Decade Ago, Microsoft Got Serious About Security | threatpost

 

Great article on Threatpost that summarizes how far we’ve come as a company  dealing with Security Challenges 10 years ago. Tim Rains, from Microsoft Trustworthy Computing,  does great job summarizing  our challenges 10 years ago with dealing with Security. This article brings back some memories of the turmoil Slammer and Blaster created for our customers. The US Business Marketing Organization (USBMO) went through a lot of turmoil, trying to get the message out quickly.  Since then thanks to folks like Steve Lipner and Eric Bidstrup, the Microsoft Security Development Lifecycle (SDL) was implemented and quickly adopted by our engineering culture here at Microsoft.

This February, I will have been at Microsoft 13 years. Working with our customers and partners to quickly handle incident response took some time to build up the capabilities. Today, this is something Microsoft Trustworthy Computing has gotten really good at. When both Slammer and Blaster hit in 2003, I remember how much effort it took to quickly respond and get help to our customers that needed it. I recall at the time, running 7X24 MSDN webcasts with information on dealing with Slammer and Blaster. We had Product Support Services engineers on the call answering and trough application sharing showing customers what to look for and steps to take.

 

George

]]> The Evolution of Elevation - Threat Modeling, Microsoft | TechNet https://docs.microsoft.com/archive/blogs/georgeop/the-evolution-of-elevation-threat-modeling-microsoft-technet Wed, 18 Jan 2012 12:58:02 GMT https://blogs.msdn.microsoft.com/georgeop/2012/01/18/the-evolution-of-elevation-threat-modeling-microsoft-technet/ The Evolution of Elevation - Threat Modeling, Microsoft | TechNet

 

Cool article by Dana Epp, Scorpion Software Corporation. Dana provides a great write up on threat modeling  and Microsoft’s approach to threat modeling over the last few years.

Regards,

George

]]> The Threat Landscape in India – More Active Than First Thought - Microsoft Security Blog - Site Home - TechNet Blogs https://docs.microsoft.com/archive/blogs/georgeop/the-threat-landscape-in-india-more-active-than-first-thought-microsoft-security-blog-site-home-technet-blogs Wed, 04 Jan 2012 11:14:36 GMT https://blogs.msdn.microsoft.com/georgeop/2012/01/04/the-threat-landscape-in-india-more-active-than-first-thought-microsoft-security-blog-site-home-technet-blogs/ The worms are back in full force. Check out the threat landscape in India. Five of the top ten families of threats in India are worms.  Tim Rains does a great job of articulating the threat our industry faces from malware. If you work in today’s IT industry, this is a must read so that you have a full understanding of what the threat is we face, and where it’s coming from. The Security Intelligence Report (SIR) version 11, provides useful data on the threat malware infection rates and where they are happening.

 

Regards,

George

Read the full article here at The Threat Landscape in India – More Active Than First Thought - Microsoft Security Blog - Site Home - TechNet Blogs

]]> Microsoft Boosts Office 365 Regulatory Compliance | PCWorld Business Center https://docs.microsoft.com/archive/blogs/georgeop/microsoft-boosts-office-365-regulatory-compliance-pcworld-business-center Wed, 14 Dec 2011 13:30:55 GMT https://blogs.msdn.microsoft.com/georgeop/2011/12/14/microsoft-boosts-office-365-regulatory-compliance-pcworld-business-center/ “In the U.S., for contracts with health-care companies that have to comply with the Health Insurance Portability and Accountability Act (HIPAA), Microsoft will include Business Associate Agreement (BAA) contract provisions drafted by the U.S. Department of Health that address legal requirements around patient data privacy and protection.”

 

The article above is a great example of companies such as Microsoft who are stepping up to help companies who have to comply with US and European regulations. Companies are going to have to start being more proactive in addressing regulatory and compliance requirements in their industries. But rather than being driven by compliance driven data security and privacy requirements, it’s better for companies to follow a software security assurance process such as the Microsoft Security Development Lifecycle that can provide prescriptive security process guidance that can help reduce vulnerabilities in their software.

 

Microsoft Boosts Office 365 Regulatory Compliance | PCWorld Business Center

]]> TechNet Blogs–Microsoft Security Blog - What You Should Know About Drive-By Download Attacks - Part 1 by Tim Rains https://docs.microsoft.com/archive/blogs/georgeop/technet-blogsmicrosoft-security-blog-what-you-should-know-about-drive-by-download-attacks-part-1-by-tim-rains Thu, 08 Dec 2011 13:32:11 GMT https://blogs.msdn.microsoft.com/georgeop/2011/12/08/technet-blogsmicrosoft-security-blog-what-you-should-know-about-drive-by-download-attacks-part-1-by-tim-rains/ Making sure everyone saw another great blog post by Tim Rains. Tim provides some great information on Drive-By Download Attacks and how they work. for this blog post, Tim focuses on how these exploits are distributed by web pages, and the use of “exploit kits”.

 

George

 

TechNet Blogs - Microsoft Security Blog

]]> RSA Conference: Fred Stock: Secure Habits: Microsoft Security Development Lifecycle Process https://docs.microsoft.com/archive/blogs/georgeop/rsa-conference-fred-stock-secure-habits-microsoft-security-development-lifecycle-process Fri, 02 Dec 2011 16:34:27 GMT https://blogs.msdn.microsoft.com/georgeop/2011/12/02/rsa-conference-fred-stock-secure-habits-microsoft-security-development-lifecycle-process/ Wow! That’s all I have to say. Thank you Fred Stock for the very nice compliment on our Microsoft SDL!

George 

RSA Conference: Fred Stock: Secure Habits: Microsoft Security Development Lifecycle Process

]]> The Curious Case of Qatar - Microsoft Security Blog - Site Home - TechNet Blogs https://docs.microsoft.com/archive/blogs/georgeop/the-curious-case-of-qatar-microsoft-security-blog-site-home-technet-blogs Tue, 22 Nov 2011 11:46:32 GMT https://blogs.msdn.microsoft.com/georgeop/2011/11/22/the-curious-case-of-qatar-microsoft-security-blog-site-home-technet-blogs/ Tim Rains does a great write up on locations with the greatest malware infection rates. From the article, Tim writes,

“It would seem that many systems in Qatar are configured with a system location setting, set to something other than “Qatar”. This suggests that, rather than using the locale settings designated for Qatar, many computer administrators are using locale settings for different locations. As a result, the reported infection rates, using the location setting, were being skewed (underreporting malware detections) for Qatar and this became evident when we started using IP geolocation.”

The Curious Case of Qatar - Microsoft Security Blog - Site Home - TechNet Blogs

]]>