Microsoft Security Development Lifecycle Explained

The Microsoft Security Development Lifecycle (SDL) is the approach Microsoft uses to integrate security into DevOps processes (sometimes called a DevSecOps approach). You can use this SDL guidance and documentation to adapt this approach and practices to your organization.  

The practices described in the SDL approach can be applied to all types of software development and all platforms from classic waterfall through to modern DevOps approaches and can be generally applied across:  

• Software – whether you are developing software code for firmware, AI applications, operating systems, drivers, IoT Devices, mobile device apps, web services, plug-ins or applets, hardware microcode, low-code/no-code apps, or other software formats. Note that most practices in the SDL are applicable to secure computer hardware development as well.  
• Platforms – whether the software is running on a ‘serverless’ platform approach, on an on-premises server, a mobile device, a cloud hosted VM, a user endpoint, as part of a Software as a Service (SaaS) application, a cloud edge device, an IoT device, or anywhere else.  

The SDL recommends 10 security practices to incorporate into your development workflows. Applying the 10 security practices of SDL is an ongoing process of improvement so a key recommendation is to begin from some point and keep enhancing as you proceed. This continuous process involves changes to culture, strategy, processes, and technical controls as you embed security skills and practices into DevOps workflows.

The 10 SDL practices are:

1. Establish security standards, metrics, and governance
2. Require use of proven security features, languages, and frameworks
3. Perform security design review and threat modeling
4. Define and use cryptography standards
5. Secure the software supply chain
6. Secure the engineering environment
7. Perform security testing
8. Ensure operational platform security
9. Implement security monitoring and response
10. Provide security training

Versions

Version	Release date	Link
1		Unreleased
2		Unreleased
2.1		Unreleased
2.2		Unreleased
3		Unreleased
3.2		http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=24308
4.1		http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=15526
4.1a		http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17701
5		http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285
5.2		http://www.microsoft.com/en-us/download/details.aspx?id=29884
6		https://www.microsoft.com/securityengineering/sdl

See also

• Trusted computing base

Further reading

1. Establish culture, strategy and processes - Innovation security (CAF Secure)
2. Define Security Practices and Controls - DevSecOps controls
3. Assess your current workloads with the well architected security assessment - Well Architected Review