AI
From Bug Bashes to a Lifecycle
Before the SDL, the Secure Windows Initiative put five people inside Windows to focus on securing features, not building security features. The team ran day-long security bug bashes across Windows, Office, Exchange, and SQL Server. Michael Howard managed IIS 3 through 5 during the Code Red and Nimda worms. Those versions had memory safety issues and canonicalization problems. IIS 6 threw away the codebase and rebuilt with threat awareness. Howard’s lexicon shifted from ACLs and tokens to threat modeling and fuzz testing.
Twenty-Five-ish Years of Evolution
The SDL started after Code Red and SQL Slammer. Microsoft published the Trustworthy Computing memo, then formalized the SDL as company-wide requirements. Later versions adapted for Agile teams. The team learned from external attacks like the PlayStation Network breach. SDL version seven settled into a yearly cadence. SolarWinds pushed supply chain security forward, and US Executive Order 14028 and ISO 27034-1 both reference the SDL. The latest model is SDL Continuous Assurance, which replaces manual activity tracking with tool-pushed telemetry.
The Case Against C and C++
Howard showed the Slammer worm code: a 256-byte UDP read copied into a 128-byte buffer created a stack-based buffer overrun. Modern tooling would catch it. Visual C++ deprecates sprintf with a fatal error. CodeQL, PREfast, and Semgrep detect it at edit or CI time. Runtime defenses like GS, ASLR, and Control Flow Guard kill the process. But Howard argued that undefined behavior in C and C++ makes memory corruption too easy. Microsoft now bans new C++ in Azure and refactors systems code into Rust.
Identity Is the New Boundary
Howard said the network is still a boundary, but identity is the new one. Compromising identity bypasses MFA. He described a real red team operation: operators entered a building through an unclosed door, placed a QR code in a kitchenette, and used a dangling OAuth redirect URI to capture refresh tokens. Microsoft deprecated device code flow in Entra ID because of phishing risk. Howard also noted that the identity chapter in his upcoming book grew from 25 to 60 pages.
Human plus AI Cuts Months to Minutes
Howard presented concrete numbers from the Entra SDK migration. Human-only resolution averaged 5.9 months. AI agents brought that to 1.6 months. Time to understand guidance and produce a pull request dropped from 13 hours to 15 minutes. Accuracy hit 98 to 100 percent, better than humans. Howard stressed the human-in-the-loop requirement. He also demonstrated that four major LLMs all produced a SHA-256 hash vulnerable to length extension attacks when given two concatenated strings.
Notable Quotes
Secure features does not equal security features. Michael Howard · ▶ Watch (10:40)
it’s time to move away from C and C++. Michael Howard · ▶ Watch (19:38)
There are no words to adequately describe how much I despise JavaScript. Michael Howard · ▶ Watch (23:40)
if it compiles, it is thread safe. Michael Howard · ▶ Watch (33:36)
the borrow checker will drive you absolutely nuts Michael Howard · ▶ Watch (33:59)
Key Takeaways
- Microsoft SDL evolved from bug bashes to continuous assurance with tool-pushed telemetry.
- C and C++ should be replaced with memory-safe languages like Rust, C#, and Go for new code.
- Identity is the new security boundary; OAuth token handling requires precise validation.
About the Speaker(s)
Michael Howard has spent over 30 years in security at Microsoft, currently in the Microsoft Red Team. He is the co-architect of the Microsoft Security Development Lifecycle and author of several books including Writing Secure Code and the upcoming Threat-Driven Software Development. He also co-hosts the Azure Security Podcast.