Financial Services Industry Employs Microsoft SDL In New Secure Software Model

Meanwhile, Microsoft releases new data showing a major drop in bugs and exploitable vulnerabilities in its software during the past year-and-a-half.
Microsoft's Security Development Lifecycle (SDL) process for writing secure applications got a big nod today from the financial services industry, which publicly rolled out its new development framework that incorporates key elements of Microsoft's approach and tools.

BITS, the technology division of The Financial Services Roundtable and the Financial Services Information Sharing and Analysis Center (FS-ISAC), issued its BITS Software Assurance Framework (PDF), a blueprint for financial services firms to write more secure internal and customer-facing applications.

Paul Smocer, president of BITS, says the framework is more of a road map for the secure development process than a detailed prescriptive process, and while it was written with the financial services industry in mind, it's widely applicable for other industries. Smocer says Microsoft, a member of BITS, was heavily involved in the development of the BITS Software Assurance Framework.