Steve Lipner brought his idea to the manager of the Windows team “half expecting to get thrown out of his office.” The idea was to stop Windows.
Not to slow it down. To stop all new development, put every developer through security training, then send them back into the existing code to hunt for flaws. A team at Microsoft had done this before with .NET, a platform with a few hundred developers. “Windows was this 9,000-person supertanker,” recalled Glenn Pittaway, who worked on software security at the company.
The pressure had been building since July 2001, when Microsoft was alerted to the Code Red worm. On January 15, 2002, Bill Gates sent a memo to every full-time Microsoft employee. “Trustworthy Computing is the highest priority for all the work we are doing,” he wrote. “So now, when we face a choice between adding features and resolving security issues, we need to choose security.”
Lipner wasn’t thrown out. He was asked to come back with a better plan, then to brief a vice president, then a senior vice president, then the head of the whole business group, Jim Allchin. “At some point it occurred to me that nobody was saying ‘no,’” Lipner said, “and that this was actually going to happen.”
The room
In February 2002, according to Microsoft’s own history, the entire Windows division shut down development and turned to security.
The hard part, Lipner said, was logistics: “getting all 8,500 rank-and-file developers up to speed on security.” The work was proprietary, so they couldn’t rent a stadium. The biggest room they could get was the Microsoft Briefing Center. It held 950 people. It was filled twice a day for five days. “There was no magic to it,” Lipner said. “We did the training 10 times.”
In a later article, Lipner described what went into the room: the team had “compressed our answers” into a four-hour course, taught by three people. Michael Howard took the developers, Jason Garms the program managers, Chris Walker the testers.
Then the developers went back to their desks and started reviewing code. Business leaders had first pushed for a two-day stand-down; Lipner’s team had asked for a month. The push lasted two months.
After
The training didn’t end the flaws. On July 16, 2003, Microsoft published a security bulletin about a hole in the Windows component that handles remote procedure calls. It rated the flaw critical for several versions of Windows, including Windows Server 2003, the system whose code the push had reviewed.
But the course outlived the push. The team built tools, an internal security audit group, and by late 2003 the first versions of what Microsoft called the Security Development Lifecycle. In 2004 senior leadership approved it as mandatory for every product and online service that faced meaningful risk.
“In other words,” Lipner said, “everything went through the SDL.”