Microsoft is moving towards releasing some of its own in-house software design tools publicly. Perhaps the part of the possible release in the light of all of the recent vulnerability discoveries is a threat-modeling tool designed to help developers create more-secure software based on usage scenarios and environments. FxCop, another security tool, is already available for download. Originally designed to enforce software design rules, FxCop is now used to analyze code for security vulnerabilities. Several other pieces of software are due to be released as well: Prefix, a tool that allows developers to analyze their source for common errors; and Prefast, another analysis tool for source text. Microsoft has a presentation available (PPT) detailing these tools.
|