Keynote: 25 Years of the Microsoft SDL
summary
SDL reaches about 25 years and claims concrete wins: buffer overruns like Slammer (256 bytes read into 128-byte buffer) become non-compilable today via deprecated sprintf warnings, Visual Studio checks, and static tools like CodeQL, Semgrep and PREfast; runtime mitigations use GS, ASLR and Control Flow Guard. Microsoft pushes Rust for new system code and bans many unsafe C APIs, moves to memory-safe languages. Continuous SDL and AI tooling cut remediation from ~5.9 months to 1.6 months and PR-to-fix from 13 hours to 15 minutes with ~98–100% verification, easing developer cognitive burden.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:49What is Microsoft SDL
- 6:49Prehistory of SDL
- 8:15IIS security lessons
- 11:04SDL evolution
- 13:34SDL global impact
- 13:55SQL Slammer analysis
- 17:26Moving to memory-safe languages
- 23:27Rust at Microsoft
- 30:10Rust’s correctness guarantees
- 36:05DevSecOps pressures
- 37:30Secure Future Initiative
- 40:18Continuous SDL
- 42:06Detecting secrets in code
- 43:33Vulnerability reduction
- 44:57Identity vulnerabilities insights
- 46:24Red team operation example
- 48:10AI in software security
- 51:27Threat modeling for AI
- 53:31AI-driven security gains
- 56:39Key takeaways
- 59:53Closing remarks
related talks
44mKeynote: 25 Years in AppSec: Looking Back, Looking Forward
31m"From Blue Screens to Orange Crabs: Microsoft’s Rusty Revolution"
45mRust
58mKeynote: Safety and Security: The Future of C and C++
36mCode Analysis: Empowering developers to write performant, reliable, and safe C++
01h 03mLifetime Safety in C++: Past, Present and Future
01h 06mmemory-safe C++
01h 01mClosing the Gap between Rust and C++ Using Principles of Static Analysis