Security Development Lifecycle for Agile Development

Security Development Lifecycle for Agile Development has now been added into the latest release of Microsoft's Security Development Lifecycle (SDL) Process Guidance.

SDLv5, issued on 31 March 2010, includes the Agile guidance first published in November 2009. This provides advice on applying lightweight software security practices when using Agile software development methods, such as Extreme Programming (XP) and Scrum.

Additional changes particularly relevant to web applications include:

• Use ViewStateUserKey or ValidateAntiForgeryTokenAttribute to add a layer of defense against Cross-Site Request Forgery (XSRF) attacks.
• Conduct an integration-points security design review with dependent product teams across your end-to-end scenarios.
• Strong log-out and session management. Proper session handling is one of the most important parts of Web application security.
• Include third-party code licensing security requirements in all new contracts.
• Use secure methods to access databases. Creating dynamic queries using string concatenation potentially allows an attacker to execute an arbitrary query through the application.
• All HTTP-based applications that use cookies must specify HttpOnly in the cookie definition for all cookies not explicitly required by legitimate scripts in the Web page.
• Internet Explorer 8 MIME handling: Sniffing OPT-OUT. This recommendation addresses functionality new in Internet Explorer 8 that may have security implications in some cases. It is recommended that for each HTTP response that could contain user controllable content, you utilize the HTTP Header X-Content-Type-Options:nosniff.
• Identify any ActiveX controls, new and existing, that can be locked to a preselected set of domains, and incorporate the SiteLock 1.15 Template for ActiveX Controls during implementation to lock each control to that set of domains.
• ClickJacking defense. For each page that could contain user controllable content, you should use a "frame-breaker" script and include the HTTP response header named X-FRAME-OPTIONS in each authenticated page.
• Use a passive security auditor. Use Watcher and Fiddler to detect vulnerabilities.

There's plenty more to read though.