Managed Extensibility Framework announcements

Microsoft adCenter: Development announcements

Microsoft ESP Platform Development (Archived) announcements

Microsoft Security Development Lifecycle (SDL) - Threat Modeling announcements

  • Link
    SDL Threat Modeling Tool v3.1.6 beta now available for download
    Dana Epp [Security MVP]

    Hey guys,

    The latest beta of the Threat Modeling tool is now available for download at: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a48cccb1-814b-47b6-9d17-1e273f65ae19&displaylang=en

    Many bugs previously reported have been fixed, along with support for Visio 2010.

    Please give the beta a download and check it out if you have open bugs. Let me know if you have any problems and I'll send it back up the chain within Microsoft!

    Happy threat modeling!

  • Link
    Announcing Elevation of Privilege: The Threat Modeling Game
    Dana Epp [Security MVP]
    I have had the pleasure over the past few months to spend some time playing with an early rendition of " Elevation of Privilege: The Threat Modeling Game". According to Adam, "Elevation of Privilege is the easiest way to get started threat modeling".  I couldn't agree more. If you have a team that is new to the whole process of threat modeling, you will want to check it out. If you are at RSA this week, drop by the Microsoft booth and pick the game up for free. If you aren't, you can download it here.

    EoP is a card game for 3-6 players. The deck contains 74 playing cards in 6 suits: one suit for each of the STRIDE threats (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service and Elevation of Privilege). Each card has a more specific threat on it.  You can see a short video on how to play and some more information about the game by checking our Adam's post here. In the end, it is a game that makes it possible to have more fun when thinking about threats. And that's a good thing.

    Even more impressive is that they have released the game under Creative Commons Attribution license which gives you freedom to share, adapt and remix the game. So you if you feel you can improve up this, step up and let everyone know!!   

    Congratulations to the SDL team for creating an innovative way to approach the concept of threat modeling.

Microsoft Security Development Lifecycle (SDL) - Tools announcements

  • Link
    Attend the upcoming MSDN Webcast "Using the Attack Surface Analyzer" on April 7, 2011
    SDL Team

    The recently released Attack Surface Analyzer tool helps developers review attack surface during the verification phase of the SDL. Additionally, Attack Surface Analyzer allows IT professionals to identify security changes as the result of installing applications on the Windows platform. By taking snapshots before and after an application is installed, Attack Surface Analyzer highlights weaknesses and security misconfigurations as issues and generates an Attack Surface report listing changes to securable objects and the computers attack surface.

     

    This webcast will walk you through how to run Attack Surface Analyzer and how to do basic analysis of the generated report.

    To register for the webcast, click here: https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032480502&Culture=en-US

     

    To download Attack Surface Analyzer, click here: http://go.microsoft.com/?linkid=9758398

  • Link
    Workaround for MSF-Agile+SDL v5.0 install error
    SDL Team

    Hi everyone,

    We've talked with some people experiencing problems when trying to install the MSF-Agile+SDL v5.0 process template. We believe these problems are a result of an incompatibility with certain configurations of Sharepoint, and we are working to correct the issue for the next release of the MSF-Agile+SDL template. In the meantime, you should be able to work around the problem by following these instructions to disable the Sharepoint features of the template:

    1. Uninstall the template if you've already installed it.
    2. Reinstall the template files, and uncheck the Additional Sharepoint Components feature during the installation process.
    3. Using your XML editor of choice, open the file <template install dir>\Process Template\Windows SharePoint Services\wsstasks.xml.
    4. Near the bottom of the file, you will see the lines:

    <!--TfsDashboardSDLAgile -->

    <feature featureId="3F6F501A-5DFF-4359-8ED8-232784DFF47E" />

    5. Comment out the second line, ie:

    <!--TfsDashboardSDLAgile -->

    <!-- <feature featureId="3F6F501A-5DFF-4359-8ED8-232784DFF47E" /> -->

    6. Save the file and close

    7. Open the Process Template Manager in Visual Studio

    8. Delete the existing "MSF for Agile Software Development plus Security Development Lifecycle (SDL) v5.0" process template.

    9. Upload the process template again, browse for <template install dir>\Process Template\process template.xml.

    10. Close the Process Template Manager.

    You should now be able to create MSF-A+SDL projects. If you're experiencing the install bug, please let us know if this helps workaround the problem (or if it doesn't).

    Thanks,

    Bryan

Model-Based Testing with Spec Explorer announcements

  • Link
    This Forum Has Been Retired
    John Boylan

    This forum has been locked; it will still be available for review in the Archived Forums folder. Any future posts on this topic should be put in the Test Tools in Visual Studio 2010 and 2012 forum.


  • Link
    Brand New Release! Spec Explorer 2010 3.5 now available
    Xiang Li

    Hello!  We are delighted to announce the newest version of Spec Explorer 2010, Release 3.5.

    Spec Explorer 2010 Release 3.5 contains new features, improved documentation, plus over 60 bug fixes. Please consult the Release Notes and our Home Page to access this release.

     

     

    This release contains new / enhanced features including:

     

    ·        Model change detecting: The model change detecting feature detects all model changes and decides if Spec Explorer needs to re-explore the model. For specific machines, if Spec Explorer detects any change in the model code, cord script files, or other inputs, or detects a tool version change, Spec Explorer will start a new exploration; otherwise, Spec Explorer will use existing exploration result files for current exploration viewing, test code generation, and user customized post processing. The UI has been updated to allow you to force Spec Explorer to re-explore the machines. This feature greatly improves the user experience by preventing unneeded lengthy validation and exploration events, which frequently happened in previous versions.

    ·        Multiple machine processing: Now you can select multiple machines in Exploration Manager and explore, generate test code, or perform post processing tasks on them. For multiple machine processing, Spec Explorer generates a summary including all information of the batch-processing.

    ·        Cord context menu: Spec Explorer adds a new context menu item “Go To Definition” in the Cord editor, which enables users to navigate to specific configurations and machines. This is part of an ongoing effort to improve the Cord editing user experience and the general integration of the tool with Visual Studio.

    We hope you enjoy this release and look forward to hearing feedback from the Spec Explorer community.

  • Link
    Have your say with the Spec Explorer User Survey!
    Rob DuWors
    Hello Spec Explorers: We seek to gain a better idea of the Spec Explorer community and who is using the tool for what. We aim to bring you the best tool ever and your help will greatly appreciated if you could take a minute to fill in the Spec Explorer User Survey.  With thanks, The Spec Explorer Team.

MS-Build, Multi-Targeting and WiX in the Visual Studio 2010 and .NET Framework 4.0 CTP announcements

  • Link
    Welcome to the "Building and Deploying Applications" forum
    kenwat
     Hi - I'm Ken Watson, the Release Manager for Visual Studio Platform. I'll be one of the moderators on this forum.

    We have provided this forum to gather your feedback on the scenarios described in the walkthroughs that shipped with Visual Studio 2010 CTP. At this stage in the release, we are interested in hearing your thoughts on the design of features presented in these walkthrough. We'll be taking more general feedback on the product when we get to the beta.

    We'll be discussing the following walkthroughs in this forum:

    - How to Create a Custom Platform
    - How to Create an Inline Task
    - How to Create Custom Property Pages
    - How to Use the C++ MSBuild Project System
    - How to Deploy an Application by Using WiX.
    - How to Prepare a Package for Non-Registry Deployment

    We look forward to hearing from you!

    thanks,
    Ken Watson
    Release Manager
    Visual Studio Platform

Multimap API Development Forum announcements

Monitor, Alert and Auto scale in Azure announcements

Managed Extensibility Framework announcements

Microsoft adCenter: Development announcements

Microsoft ESP Platform Development (Archived) announcements

Microsoft Security Development Lifecycle (SDL) - Threat Modeling announcements

  • Link
    SDL Threat Modeling Tool v3.1.6 beta now available for download
    Dana Epp [Security MVP]

    Hey guys,

    The latest beta of the Threat Modeling tool is now available for download at: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=a48cccb1-814b-47b6-9d17-1e273f65ae19&displaylang=en

    Many bugs previously reported have been fixed, along with support for Visio 2010.

    Please give the beta a download and check it out if you have open bugs. Let me know if you have any problems and I'll send it back up the chain within Microsoft!

    Happy threat modeling!

  • Link
    Announcing Elevation of Privilege: The Threat Modeling Game
    Dana Epp [Security MVP]
    I have had the pleasure over the past few months to spend some time playing with an early rendition of " Elevation of Privilege: The Threat Modeling Game". According to Adam, "Elevation of Privilege is the easiest way to get started threat modeling".  I couldn't agree more. If you have a team that is new to the whole process of threat modeling, you will want to check it out. If you are at RSA this week, drop by the Microsoft booth and pick the game up for free. If you aren't, you can download it here.

    EoP is a card game for 3-6 players. The deck contains 74 playing cards in 6 suits: one suit for each of the STRIDE threats (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service and Elevation of Privilege). Each card has a more specific threat on it.  You can see a short video on how to play and some more information about the game by checking our Adam's post here. In the end, it is a game that makes it possible to have more fun when thinking about threats. And that's a good thing.

    Even more impressive is that they have released the game under Creative Commons Attribution license which gives you freedom to share, adapt and remix the game. So you if you feel you can improve up this, step up and let everyone know!!   

    Congratulations to the SDL team for creating an innovative way to approach the concept of threat modeling.

Microsoft Security Development Lifecycle (SDL) - Tools announcements

  • Link
    Attend the upcoming MSDN Webcast "Using the Attack Surface Analyzer" on April 7, 2011
    SDL Team

    The recently released Attack Surface Analyzer tool helps developers review attack surface during the verification phase of the SDL. Additionally, Attack Surface Analyzer allows IT professionals to identify security changes as the result of installing applications on the Windows platform. By taking snapshots before and after an application is installed, Attack Surface Analyzer highlights weaknesses and security misconfigurations as issues and generates an Attack Surface report listing changes to securable objects and the computers attack surface.

     

    This webcast will walk you through how to run Attack Surface Analyzer and how to do basic analysis of the generated report.

    To register for the webcast, click here: https://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032480502&Culture=en-US

     

    To download Attack Surface Analyzer, click here: http://go.microsoft.com/?linkid=9758398

  • Link
    Workaround for MSF-Agile+SDL v5.0 install error
    SDL Team

    Hi everyone,

    We've talked with some people experiencing problems when trying to install the MSF-Agile+SDL v5.0 process template. We believe these problems are a result of an incompatibility with certain configurations of Sharepoint, and we are working to correct the issue for the next release of the MSF-Agile+SDL template. In the meantime, you should be able to work around the problem by following these instructions to disable the Sharepoint features of the template:

    1. Uninstall the template if you've already installed it.
    2. Reinstall the template files, and uncheck the Additional Sharepoint Components feature during the installation process.
    3. Using your XML editor of choice, open the file <template install dir>\Process Template\Windows SharePoint Services\wsstasks.xml.
    4. Near the bottom of the file, you will see the lines:

    <!--TfsDashboardSDLAgile -->

    <feature featureId="3F6F501A-5DFF-4359-8ED8-232784DFF47E" />

    5. Comment out the second line, ie:

    <!--TfsDashboardSDLAgile -->

    <!-- <feature featureId="3F6F501A-5DFF-4359-8ED8-232784DFF47E" /> -->

    6. Save the file and close

    7. Open the Process Template Manager in Visual Studio

    8. Delete the existing "MSF for Agile Software Development plus Security Development Lifecycle (SDL) v5.0" process template.

    9. Upload the process template again, browse for <template install dir>\Process Template\process template.xml.

    10. Close the Process Template Manager.

    You should now be able to create MSF-A+SDL projects. If you're experiencing the install bug, please let us know if this helps workaround the problem (or if it doesn't).

    Thanks,

    Bryan

Model-Based Testing with Spec Explorer announcements

  • Link
    This Forum Has Been Retired
    John Boylan

    This forum has been locked; it will still be available for review in the Archived Forums folder. Any future posts on this topic should be put in the Test Tools in Visual Studio 2010 and 2012 forum.


  • Link
    Brand New Release! Spec Explorer 2010 3.5 now available
    Xiang Li

    Hello!  We are delighted to announce the newest version of Spec Explorer 2010, Release 3.5.

    Spec Explorer 2010 Release 3.5 contains new features, improved documentation, plus over 60 bug fixes. Please consult the Release Notes and our Home Page to access this release.

     

     

    This release contains new / enhanced features including:

     

    ·        Model change detecting: The model change detecting feature detects all model changes and decides if Spec Explorer needs to re-explore the model. For specific machines, if Spec Explorer detects any change in the model code, cord script files, or other inputs, or detects a tool version change, Spec Explorer will start a new exploration; otherwise, Spec Explorer will use existing exploration result files for current exploration viewing, test code generation, and user customized post processing. The UI has been updated to allow you to force Spec Explorer to re-explore the machines. This feature greatly improves the user experience by preventing unneeded lengthy validation and exploration events, which frequently happened in previous versions.

    ·        Multiple machine processing: Now you can select multiple machines in Exploration Manager and explore, generate test code, or perform post processing tasks on them. For multiple machine processing, Spec Explorer generates a summary including all information of the batch-processing.

    ·        Cord context menu: Spec Explorer adds a new context menu item “Go To Definition” in the Cord editor, which enables users to navigate to specific configurations and machines. This is part of an ongoing effort to improve the Cord editing user experience and the general integration of the tool with Visual Studio.

    We hope you enjoy this release and look forward to hearing feedback from the Spec Explorer community.

  • Link
    Have your say with the Spec Explorer User Survey!
    Rob DuWors
    Hello Spec Explorers: We seek to gain a better idea of the Spec Explorer community and who is using the tool for what. We aim to bring you the best tool ever and your help will greatly appreciated if you could take a minute to fill in the Spec Explorer User Survey.  With thanks, The Spec Explorer Team.

MS-Build, Multi-Targeting and WiX in the Visual Studio 2010 and .NET Framework 4.0 CTP announcements

  • Link
    Welcome to the "Building and Deploying Applications" forum
    kenwat
     Hi - I'm Ken Watson, the Release Manager for Visual Studio Platform. I'll be one of the moderators on this forum.

    We have provided this forum to gather your feedback on the scenarios described in the walkthroughs that shipped with Visual Studio 2010 CTP. At this stage in the release, we are interested in hearing your thoughts on the design of features presented in these walkthrough. We'll be taking more general feedback on the product when we get to the beta.

    We'll be discussing the following walkthroughs in this forum:

    - How to Create a Custom Platform
    - How to Create an Inline Task
    - How to Create Custom Property Pages
    - How to Use the C++ MSBuild Project System
    - How to Deploy an Application by Using WiX.
    - How to Prepare a Package for Non-Registry Deployment

    We look forward to hearing from you!

    thanks,
    Ken Watson
    Release Manager
    Visual Studio Platform

Multimap API Development Forum announcements

Monitor, Alert and Auto scale in Azure announcements