Eric Mittelette and Stanisloas Quastano share stories of Microsoft Security and Scalability lessons learned at FailCon France 2012.

1. Security & Software
Disasters & changing perception
Eric Mittelette & Stanislas Quastana | Microsoft

2. Do you remember those dark days ?
May 4th 2000
July 13th 2001
September 28th 2001
January 25th 2003
August 13th 2003

3. As Microsoft employees we do

10. 15 minutes before SQL Slammer infection

11. SQL Slammer (aka Sapphire) infection

12. Blaster
(aka LOVE YOU SAN)

16. Why we fail ?

17. Reason 1 : features,
features, features….

20. Reason 2 : Security was
not in Developer’s DNA

21. Reason 3 : Everything was
installed and started by
default
Ex: IIS Web Server

23. Which response ?

24. “Computing is already an important
part of many people’s lives. Within
ten years, it will be an integral and
indispensable part of almost
everything we do. Microsoft and the
computer industry will only succeed
in that world if CIOs, consumers and
everyone else sees that Microsoft
has created a platform for
Trustworthy Computing”

25. “We have done a great job of
having teams work around the
clock to deliver security fixes for
any problems that arise.
Our responsiveness has been
unmatched – but as an industry
leader we can and must do
better”

26. “Flaws in a single Microsoft
product, service or policy not
only affect the quality of our
platform and services overall,
but also our customers’ view of
us as a company”

28. “So now, when we face a choice
between adding features and
resolving security issues, we
need to choose security”

29. So what we did ?

30. Stop all development
The 1st time in our history

31. Every Microsoft developer : back to school !!!
Mandatory annual security training

32. « One book to
protect them all »

33. Dear developers
Few security bugs
in your code
= more money in
your pocket

34. SDLC is the
Microsoft
security audit
& expertise
substance
published as a
methodology

35. Security Team created

36. Final Security Review mandatory

37. Did it work ?
First results

40. Helping IT customers in their job

41. As you see, we did a lot of things
But…

42. “Security is a journey,
not a destination”

43. 10 years later
Is it better ?

46. “Security is a journey,
not a destination”

47. Sometimes it’s better to be
the first…

48. Security is an industry problem not
a single company issue

49. Really ?

55. same feature but 10 years later

56. “Security is a journey,
not a destination”

58. “Security is a journey,
not a destination”

59. Thanks you 
@EricMitt & @SQuastana