Editor's Note: In last month's newsletter, we incorrectly attributed the Security Tip of the Month to Dan Griffin, the author of our Security Tip for January. February's tip of the month, "Threat Modeling and Agile Development Practices" was written by Chas Jeffries, Security Architect, Microsoft Services. Thanks, Chas, for the great, informative article!
NOTE FROM THE EDITOR
 March's Security Newsletter is here!
Have you ever wondered how many security updates you have deployed in the last ten years, or how many pieces of malware you have protected your organization from?
As part of Trustworthy Computing's ten-year milestone, we recently released a special edition of the Security Intelligence Report (SIR) called, "The evolution of malware and the threat landscape - a 10-year review," that contains some very interesting new data.
Figures (clockwise from top left): relative severity of vulnerabilities disclosed since 2002 across the entire industry; average number of CVEs per MSRC security bulletin since the first half of 2005; worms, trojan downloaders and droppers, and password stealers and monitoring tools categories since 2006
In addition to the special edition of the SIR, we have also released a new case study that highlights how one of the largest Internet service providers (ISPs) in Europe, TeliaSonera, helps maintain one of the consistently cleanest networks in the world. If you help manage security for your organization's network, you will want to check this out.
Also, we have released an interactive Trustworthy Computing timeline featuring new video content that looks back at how the security world has changed over the past ten years, and that includes interviews with high profile security experts from the industry.
Best regards,
Tim Rains, Director, Microsoft Trustworthy Computing
 |  |
Microsoft and Financial Services Industry Leaders Target Zeus Botnets
Microsoft's Digital Crimes Unit, in collaboration with key partners, recently executed a coordinated global action against some of the worst known cybercrime operations fueling online fraud and identity theft today. Explore how, with this legal and technical action, a number of the most harmful botnets using the Zeus family of malware worldwide have been disrupted in an unprecedented, proactive cross-industry operation against this cybercriminal organization.
| Building Global Trust Online Volume 2: Policymaker Guide to Privacy, Safety, and Security
Find overviews of key issues, a summary of Microsoft's response to these issues, and a list of helpful resources and links for further reading and support. New topics discussed in Volume 2 include supply chain security, privacy by default, digital citizenship, combatting online fraud, and accessible technologies.
| | |  |  | |
Security Tip of the Month: How to Get Started with Threat Modeling
Threat modeling allows software architects to identify and mitigate potential security issues early, when issues are relatively easy and cost-effective to resolve. If you aren't familiar with threat modeling, one easy way to get started is with the Elevation of Privilege (EoP) card game. Designed by Microsoft to help those new to threat modeling engage with the practice in a fun and educational way, EoP enables you to learn about spoofing, tampering, repudiation, denial of service, and other threats while earning points to challenge your fellow developers.
You can often find EoP decks at Microsoft and third-party events like the RSA Security Conference, but you can also download the game anytime by visiting www.microsoft.com/security/sdl/adopt/eop.aspx. Why not grab a copy today and explore?
| IT Infrastructure Threat Modeling Guide
Learn how to develop IT infrastructure threat modeling processes for your environment and prioritize your IT infrastructure security investments. Leveraging the existing Microsoft Security Development Lifecycle (SDL) threat modeling process, this guide provides an easy-to-understand method that enables you to develop threat models specific to your infrastructure.
| SDL Threat Modeling Tool
Download this free tool designed to make threat modeling easier for developers of all skill levels—then learn how to kick off the threat modeling process, analyze threats, track dependencies, and more with Getting Started with the SDL Threat Modeling Tool.
| Reinvigorating your Threat Modeling Process
Familiarize yourself with some approaches to threat modeling that can be employed by development teams of any size.
| Microsoft Baseline Security Analyzer (MBSA)
Download a free tool to help you improve your security management process by detecting common security misconfigurations and missing security updates on your computer systems.
| Microsoft Security Assessment Tool (MSAT) Demo
Watch an in-depth demonstration on how to use MSAT to build your business risk profile, create an assessment of the current security state of your business IT infrastructure, and review specific guidance to strengthen the security of your organization. Click here to learn more and download the tool.
| | | | | |
