The Curious Engineer

All blogs / Security

Michael Howard's Web Log

learn.microsoft.com/en-us/archive/blogs/michael_howard

A Simple Software Security Guy at Microsoft!

SecuritySoftware / engineering practiceMicrosoft blogsMSDN archive

’05’10’15’20’25
Posts
332 from 29 Jan 2004 to 3 Jun 2016
Posting
archived, read-only
Kind
personal blog
Feed
https://learn.microsoft.com/en-us/archive/blogs/michael_howard/feed.xml

2016 4

  1. Never Thought I'd Still be Dealing with This: Insecure ActiveX Controls!
  2. Understanding that Microsoft Azure PaaS and IaaS defenses are often different
  3. Cloud-based Solutions, Threat Modeling and Shared Security Responsibility
  4. Refactoring C and C++ Code for Security

2009 5

  1. Security Sessions at TechEd in Australia and New Zealand
  2. ATL, MS09-035 and the SDL
  3. Integrating the SDL process into Visual Studio
  4. A Conversation About Threat Modeling
  5. Ken Johnson (Skywing) joins Microsoft

2008 46

  1. Free Download: Writing Secure Code for Windows Vista
  2. Secure software development practices 'not rocket science'
  3. A Proactive Approach to Building a Successful Security Development Lifecycle Program
  4. Improvements in Office Security
  5. Volume 5 of the Microsoft Security Intelligence Report is out
  6. Security-Related MSDN Magazine Articles
  7. Agile SDL
  8. SAFECode releases "Fundamental Practices for Secure Software Development" document
  9. Practical Defense in Depth
  10. Twitter Feed
  11. SDL Evolution
  12. James Whittaker has a blog
  13. GOOG Chrome's use of NX/DEP
  14. Kim Cameron on GOOGs single sign on design vulnerability
  15. SDL and the XSS Filter
  16. Overlong UTF-8 Escapes Bite
  17. Security is bigger than finding and fixing bugs
  18. How Very True
  19. Improve Security with "A Layer of Hurt"
  20. Insecure 3rd party software updaters
  21. SQL Server and the Windows Server 2008 Firewall
  22. More on Heap Corruption and Process Termination
  23. Giving SQL Injection the Respect it Deserves
  24. Crispin has a blog!
  25. Oh No! Security Metrics!
  26. Microsoft Security Development Lifecycle (SDL) 3.2 documentation now available for download
  27. Internet Explorer 8.0 and Data Execution Prevention (DEP/NX)
  28. When adding security bugs to your code is not your fault!
  29. "How Do I?" Videos for Security
  30. IE8 Activity to lookup CVEs and Microsoft bulletins
  31. Protecting Your Code with Visual C++ Defenses
  32. The impact of the SDL on Microsoft SQL Server
  33. Some thoughts about Windows Server 2008
  34. The First Step on the Road to More Secure Software is admitting you have a Problem
  35. FAQ about HeapSetInformation in Windows Vista and Heap Based Buffer Overruns
  36. Introducing SAFECode
  37. More trustworthy election systems via SDL?
  38. New NX APIs added to Windows Vista SP1, Windows XP SP3 and Windows Server 2008
  39. My Daughter will never be a Spy
  40. Windows Vista Crypto Modules now FIPS 140-2 Certified
  41. Crispin Cowan joins the Windows Security Team!
  42. Timely Microsoft Office 2003 SP3 Advice from David LeBlanc
  43. Cry or Smile? You Decide...
  44. "Open-source projects certified as secure" – huh?
  45. VBootkit vs. Bitlocker in TPM mode
  46. Recent Symantec and IBM vulnerabilities, giblets, banned APIs and the SDL

2007 67

  1. Common Criteria: Is it Safe?
  2. It's Official: Jeff Jones has *WWAYYY* Too Much Time on His Hands
  3. Counterpoint to my SDL post
  4. Security is not all about Security Updates
  5. Today's Dilbert :)
  6. Reminder: Microsoft Security Intelligence Report - Webcast on Wed 7 Nov
  7. Oracle’s Original Unbreakable Paper
  8. I'm at TechEd in Barcelona this week
  9. New Microsoft Security Intelligence Report Available
  10. Dev Tip: Opening Commonly-Accessed Files
  11. News Items that Interested me this Week
  12. Lessons Learned from Five Years of Building More Secure Software
  13. Update on the Threat Modeling Process
  14. Bluehat Audio Available
  15. New Version of Application Verifier (appverif) available
  16. Update on DropMyRights
  17. Privacy Tip o' the Day
  18. Some of us won't be at Blackhat
  19. Iron Chef at BlackHat
  20. Inspect Your Gadget
  21. Windows Vista Integrity Paper
  22. My Last Day in Redmond
  23. Lessons Learned from MS07-029: The DNS RPC Interface Buffer Overrun
  24. "How Software is Built" Interview
  25. SDL Crypto Code Review Macro
  26. SDL Training at the Microsoft Security Response and Safety Summit
  27. The Bluetooth Keyboard Mystery: Solved.
  28. Well, I never expected this. Take 2
  29. Well, I wasn't expecting that!
  30. The Most Complex SAL annotation
  31. From the Mouths of Babes
  32. At TechEd this Week
  33. Oil Change or Culture Change
  34. Half Of Windows Vista Adoption Driven By Security
  35. Secure coding lessons from Microsoft
  36. Windows Vista ISV Security Paper Available
  37. More on security education, or lack of...
  38. Security Education v. Security Training
  39. The Strangest Vista "bug" you've ever heard of - EVER!
  40. Lessons Learned from the Animated Cursor bug
  41. SDL blog is live
  42. Writing Secure Code for Windows Vista is Shipping!
  43. I'm moving to Austin!
  44. CodeGear’s new Delphi 2007 supports ASLR and NX
  45. How Microsoft Security Bulletin MS07-017 affected Windows Vista
  46. Hardening Stack-based Buffer Overrun Detection in VC++ 2005 SP1
  47. Symantec: Microsoft-authored code will become more difficult to exploit
  48. Surprise, Microsoft Listed as Most Secure OS
  49. Windows Vista - 90 Day Vulnerability Report
  50. I think I have a blackhat in my midst
  51. My Take on Windows Vista Security “Vulnerabilities”
  52. How I will judge Windows Vista Security
  53. UAC Deep dive over on Channel9
  54. List of Banned APIs now available
  55. New Book: Writing Secure Code for Windows Vista
  56. How to get a US Passport in 1.5h Hours
  57. UAC BS
  58. Something Windows Vista Parental Controls cannot protect against
  59. What is it that makes security hard?
  60. Security Features vs. Convenience
  61. A couple of interesting security blog posts
  62. How not to write secure Web apps - and get to see Steve Jobs for Free!
  63. Why Windows Vista is unaffected by the VML Bug
  64. Windows Live OneCare v1.5 is released to manufacturing
  65. My Take on Visual Studio 2005 SP1 and Windows Vista
  66. Visual Studio 2005 Service Pack 1 Update for Windows Vista Beta Available
  67. eXPired Poster Available!

2006 75

  1. Online Security Sessions from TechEd IT Forum Available
  2. ASLR and the new linker
  3. Update on Internet Explorer 7, DEP and Adobe Software
  4. Windows Vista, ASLR, DEP and OEMs
  5. Wresting free from a software straitjacket
  6. Microsoft beats Oracle in security showdown
  7. Which Database is More Secure? Oracle vs Microsoft
  8. Anti-Cross Site Scripting Library v1.5 Now Available
  9. eXPired!
  10. Microsoft SQL Server Runs the Security Table
  11. Symantec's "The Mac OS X Threat Landscape: An Overview"
  12. Jim's Comments about Windows Vista and Antivirus software
  13. Microsoft hosts OEM partners for a crash-course in SDL (Day Three)
  14. Microsoft hosts OEM partners for a crash-course in SDL (Day Two)
  15. Windows Vista Security Guide Now Available
  16. Microsoft hosts OEM partners for a crash-course in SDL (Day One)
  17. The Security Development Lifecycle (SDL). Advantage, Microsoft
  18. The Security Development Lifecycle (SDL). Advantage, Microsoft
  19. Something else to look out for when reviewing code
  20. MSDN Yearly Security Edition
  21. Alleged Bugs in Windows Vista’s ASLR Implementation
  22. Developing More-Secure Microsoft® ASP.NET 2.0 Applications Now Available
  23. The Sardonic Mr. Jones
  24. Silver Bullet Security Podcast Interview
  25. Whatever Happened to sprintf(..., “%n”,...)?
  26. Visual Studio 2005 SP1 Beta, Windows Vista and ASLR
  27. A Chronology of Data Breaches
  28. Gamefest Presentations now available
  29. “Hunting Security Bugs” now available from Microsoft Press
  30. Miscellaneous Windows Vista Security Stuff
  31. New Security Resources Available
  32. Protecting against Pointer Subterfuge (Redux)
  33. “Microsoft Dynamics Writing Secure X++ Code” Paper now available
  34. Some of us are *NOT* in Las Vegas!
  35. A Process for Performing Security Code Reviews
  36. External Security Testing and Windows Vista
  37. Dave G. at Matasano comments on Vista TCP/IP Stack
  38. Interview with the Open Source Software Lab
  39. Adam Shostack Joins The Team!
  40. Matasano Interviews IE Lead PM Christopher Vaughan
  41. Windows Vista Security – A Bigger Picture
  42. Windows Vista Address Space Layout Randomization – What is Randomized?
  43. Microsoft under attack - and it's not what you think
  44. SDL book is shipping!
  45. Address Space Layout Randomization in Windows Vista
  46. Windows Vista Security Enhancements
  47. PREfast, SAL and the Windows SDK
  48. Online Crypto Class Available
  49. A Brief Introduction to the Standard Annotation Language (SAL)
  50. Privacy Breach Impact Calculator
  51. SetSAFER and .NET Framework 2.0
  52. New hire into our group - James Whittaker
  53. A New Book: The Security Development Lifecycle (Microsoft Press, 2006)
  54. Two factor authn
  55. Non-admin best practices in Windows XP
  56. Regulatory Compliance Demystified
  57. An Interesting Observation from Bluehat #3
  58. A useful primer to Integer overflows/underflows
  59. Security Analogies are usually Wrong
  60. Microsoft Anti-Cross Site Scripting Library V1.0 Available
  61. List of useful security libraries
  62. Windows Defender Beta 2 is out!
  63. Pulverize, Incinerate and Disintigrate
  64. Safe Integer Arithmetic in C
  65. An Update on David LeBlanc
  66. New Internet Explorer 7 Beta 2 Preview available
  67. Protecting against Pointer Subterfuge (Kinda!)
  68. How long will that crypto key be useful?
  69. Blue Hat 2005 - Security Researchers come to Microsoft
  70. Code Scanning Tools Do Not Make Software Secure
  71. CERTs Virtual Training Environment
  72. Russinovich and the WMF Flaw (MS06-001)
  73. strlen_s, where for art thou?
  74. You heard it here first!
  75. Windows QuickTime users - APPLY THE PATCH!!

2005 54

  1. Integer Overflow and operator::new
  2. You'll get a kick out of this...
  3. More Attack Surface Reduction in IIS7
  4. ACLs on Sockets
  5. New Security Features in Visual Studio 2005
  6. Security Symposium @ the PDC
  7. Understanding Security in Microsoft Internet Explorer 6 in Windows XP SP2
  8. Even more for the Patterns & Practices folks
  9. MBSA v2 Visio Connector
  10. Security "How To" Index
  11. Comments from Gartner about Microsoft's Security Work
  12. "19 Deadly Sins" Update
  13. SDL Document now in Ten Languages
  14. Busy couple of days for security updates
  15. The 19 Deadly Sins of Software Security
  16. A safe browser? No longer in the lexicon...
  17. The Bluehat Sessions
  18. A Nice Source of 'Vintage' Security Papers
  19. The joy of netsh
  20. Hidden Message in Writing Secure Code 2nd Ed
  21. File Checksum Integrity Verifier utility
  22. Writing Secure Web Browsers is Hard
  23. Microsoft unveils details of software security process
  24. Comments on recent Firefox security bugs
  25. Visio Connector for MBSA available
  26. Microsoft Windows Security Resource Kit, Second Edition Released
  27. More Integer Overflow stuff
  28. Is Microsoft IIS 6.0 more secure than Apache HTTP Server 2.0?
  29. Security Management - Windows, Linux Security Notifications
  30. A couple of good/upbeat news items - all this work is paying off!
  31. Office Smart Tags for CVE and Microsoft Security Bulletins
  32. Hell Hath No Fury...
  33. Protect Your Windows Network: From Perimeter to Data
  34. Repel Attacks on Your Code with the Visual Studio 2005 Safe C and C++ Libraries
  35. In Praise of Windows Server 2003 SP1
  36. Windows Server 2003 SP1 is now available
  37. Clinic 2806: Microsoft Security Guidance Training for Developers
  38. Security Development Lifecycle (SDL) document is now live
  39. Steve Friedl's Unixwiz.net Tech Tips: An Illustrated Guide to Cryptographic Hashes
  40. Follow-up on NNNNnnnooooo....!
  41. NNNNNOOOOooooo......!
  42. RootkitRevealer from SysInternals
  43. Security Education - Yay, again!
  44. Update to Microsoft AntiSpyware beta now available
  45. MSRC @ RSA
  46. Security Stuff in Whidbey - More Secure Buffer Function Calls: AUTOMATICALLY!
  47. Security Stuff in Whidbey - The Safer CRT
  48. SAFER and Internet Explorer
  49. Interesting set of "Protect yourself online" articles
  50. Digital Blackbelt Series: Defend your code from attacks
  51. Trustworthy Computing @ 3
  52. Browsing the Web and Reading E-mail Safely as an Administrator, Part 2
  53. Cryptographically Secure Random number on Windows without using CryptoAPI
  54. Microsoft Windows AntiSpyware Beta One Available for download..

2004 81

  1. Windows XP Service Pack 2: The Inside Story
  2. Shell Extension for DropMyRights
  3. "How can I Trust Firefox" blog by Torr
  4. MSN Phishing and Scams site
  5. Microsoft Acquires Anti-Spyware Leader GIANT Company
  6. Evils of strncat and strncpy - Answers
  7. Windows Server 2003 SP1 Release Candidate Available
  8. Microsoft Security Education
  9. New Code Secure Column - "Browsing the Web and Reading E-mail Safely as an Administrator"
  10. SAMBA Users should apply this patch ASAP
  11. The Election and Signed Integers
  12. Ya Gotta Larf
  13. Spam senders convicted in first felony case
  14. A Phishing Attempt in my Inbox
  15. NSA Posts Mac OS X 10.3.x security guide
  16. The Evils of strncat and strncpy redux
  17. Buffer Overflow in Apache 1.3.xx fixed on Bugtraq - the evils of strncpy and strncat!
  18. A New Way to Detect Integer Overflows?
  19. What about .NET vs Java Security?
  20. Updated Writing Secure Code Errata
  21. Security issue of MSDN is out today
  22. Follow-up on IIS6 and Apache Security
  23. IIS6 vs Apache2 Security Defects
  24. Online Chat with Members of the Security Business Unit
  25. YAASN.1B (Yet-Another-ASN.1-Bug)
  26. Finally, a book on Privacy for Developers
  27. More people warming up to Threat Modeling
  28. Random Threat Modeling Thoughts
  29. IIS Auth Diagnostic tool now available
  30. Ya Gotta Larf
  31. Windows XP SP2 Application Compat Guide Available
  32. Windows XP SP2 and Nikon Software
  33. Updated MBSA now available
  34. Windows XP SP2 Privacy Statements Released
  35. Writing Secure Code 2nd Ed Errata
  36. A little more info on raw sockets and Windows XP SP2
  37. "Changes in Functionality in Microsoft Windows XP SP2" now available
  38. My Daily list o' Links
  39. A list of Code Secure columns
  40. "Hey Dad, let's go Phishing"
  41. More XPSP2 Goodies
  42. Frank Swiderski presents the Threat Modeling tool on Channel9
  43. Microsoft Office Remove Hidden Data add-in version 1.1 is now available
  44. Article: "Inside Windows XP Service Pack 2 RC2"
  45. Internet Explorer and "trust prompts" in Windows XPSP2
  46. Some of the new stuff in Windows XP SP2
  47. "Assessing Network Security" is released
  48. "Threat Modeling" is Released
  49. Why Sasser did not infect Windows Server 2003
  50. TCP & UDP Ports Used by Microsoft Apps
  51. Windows XP SP2 Release Candidate 2 is out!
  52. Debugging an ASP.NET application as a non-admin
  53. Threat Modeling
  54. Microsoft Security Bulletin RSS Feed
  55. Updated Writing Secure Code 2nd Ed Errata
  56. Updated info about Threat Modeling tool
  57. Threat Modeling tool now available
  58. Why Blaster did not infect Windows Server 2003
  59. The Antivirus Defense-in-Depth Guide Released to Web
  60. Hackers Hacked by Hackers (!?)
  61. Do you hate security updates?
  62. Security Management
  63. Transmeta chips to support 'NX'
  64. IT Security at Microsoft Overview
  65. Security Guidance Training for Developers
  66. How to think about Security
  67. Security in Microsoft Products - a chat with Mike Nash
  68. Administering Windows Servers through one port
  69. The Spread of the Witty Worm
  70. Sasser Arrest
  71. An Update on the Windows Server 2003 Vulnerability Count
  72. Why 'Sasser' does not affect Win2003
  73. Updated C Runtime in Whidbey - goodbye strcpy!
  74. Security Progress at Microsoft
  75. Kewl Tools
  76. Office2003/XP Remove Hidden Data tool Available
  77. Security Fix CD's now available
  78. Updated Errata for Writing Secure Code 2nd Edition
  79. The IE Patch (MS04-004) demystified
  80. *EVEN* more stuff on Integer Overruns
  81. More Integer Overrun Stuff...