• United States



Chief Executive Officer, Security Innovation

Will Microsoft SDL change the world?

Sep 19, 20082 mins
Business ContinuityCareersData and Information Security

Last year, Microsoft unveiled SDL (Microsoft’s proprietary Security Development Lifecycle) to a few select customers who are active on the .NET and Windows platform. The response was overwhelmingly positive and this week Microsoft announced its SDL Pro Network initiative — a collection of third-party security companies authorized to help organizations formally adopt and roll out SDL through training, consulting, and products at their disposal. (see: and for more detail.)

It’s about time. For years, organizations have maintained a reactive position to software security related issues. Only in the most progressive development organizations has there been education and tooling put in place to build security into software. The SDL program from Microsoft represents the largest effort to date to create some standards for security development best practices.

Jon Oltsik of Enterprise Strategy Group thinks, “Microsoft deserves high praise for creating, formalizing, and improving SDL as it has led to better software for the masses…. Organizations that embrace SDL can improve the security of their code while decreasing the cost of maintenance and security operations—a true win-win.” (see

Right on, Jon! This initiative will help organizations tackle specific challenges in developing secure applications on the Windows and .NET platforms and mitigate consumer risk through the use of more secure software. In the absence of an industry standard, I would love to see widespread adoption of SDL and have it evolve into an accepted standard. Without a baseline for secure software development, it is difficult for consumers and vendors alike to properly assess what “due diligence” is being taken with respect to secure software development and how to benchmark subsequent efforts.

I do believe that many organizations WANT to develop and deploy more software, but they don’t have the knowledge or blueprint to do so. This initiative provides definitive guidance that will give organizations the confidence and direction they need in their pursuit of secure software development.

Will Microsoft SDL change the world? Certainly not overnight. But this is certainly a step in the right direction and I, for one, applaud Microsoft’s efforts – both internally and publicly.

Chief Executive Officer, Security Innovation

Ed Adams is a software executive with successful leadership experience in various-sized organizations that serve the IT security and quality assurance industries. As CEO, Mr. Adams applies his security and business skills, as well as his pervasive industry experience in the software quality space, to direct application security experts to help organizations understand the risks in their software systems and develop programs to mitigate those risks. The company has delivered high-quality risk solutions to the most recognizable companies in the world including Microsoft, IBM, Fedex, ING, Sony, Nationwide and HP.