Application & OT Security · Intermediate

Microsoft Security Development Lifecycle (SDL)

Microsoft's prescriptive secure development process defining security practices from training and requirements through release and response.

Definition

Introduced in 2004 after the Trustworthy Computing initiative, the SDL defines practices such as security training, defining security requirements and metrics, threat modeling, using approved tools, deprecating unsafe functions, static and dynamic analysis, penetration testing and an incident response plan. It popularized threat modeling with STRIDE and the Microsoft Threat Modeling Tool.

Related terms