The Trustworthy Computing Security Development Lifecycle
Abstract
This paper discusses the trustworthy computing security development lifecycle (or simply the SDL), a process that Microsoft has adopted for the development of software that needs to withstand malicious attack. The process encompasses the addition of a series of security-focused activities and deliverables to each of the phases of Microsoft's software development process. These activities and deliverables include the development of threat models during software design, the use of static analysis code-scanning tools during implementation, and the conduct of code reviews and security testing during a focused "security push". Before software subject to the SDL can be released, it must undergo a final security review by a team independent from its development group. When compared to software that has not been subject to the SDL, software that has undergone the SDL has experienced a significantly reduced rate of external discovery of security vulnerabilities. This paper describes the SDL and discusses experience with its implementation across a range of Microsoft software.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In an effort to address the issue of lack of racial diversity in general HCI studies, the authors were able to recruit a balanced mix of participants in terms of race.
“We want to point out that, in an effort to address the issue of lack of racial diversity in general HCI studies [ 45 ], we were able to recruit a balanced mix of participants in terms of race.”
From "It would work for me too": How Online Communities Shape Software Developers' Trust in AI-Powered Code Generation Tools (2024) · cites this paper as [45]
Cites
Still being checked.
Cited by
Sorted by citations
On lightweight mobile phone application certification
Enck, W., Ongtang, M., & McDaniel, P. D. (2009) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1653662.1653691 · Cited by 926 · see citing works
Hardware-Based Trusted Computing Architectures for Isolation and Attestation
Maene, P., Götzfried, J., de Clercq, R., Müller, T., Freiling, F., & Verbauwhede, I. M. R. (2017) · IEEE Transactions on Computers · doi:10.1109/tc.2017.2647955 · Cited by 156 · see citing works
Security Requirements for the Rest of Us: A Survey
Tøndel, I. A., Jaatun, M. G., & Meland, P. H. (2008) · IEEE Software · doi:10.1109/ms.2008.19 · Cited by 129 · see citing works
Seacord, R. C. (2006) · Cited by 124 · see citing works
The Application of a New Secure Software Development Life Cycle (S-SDLC) with Agile Methodologies
Mohino, J. D. V., Higuera, J. B., Higuera, J. R. B., & Montalvo, J. A. S. (2019) · Electronics · doi:10.3390/electronics8111218 · Cited by 107 · see citing works
Systematic Literature Review on Security Risks and its Practices in Secure Software Development
Khan, R. A., Khan, S. U., Khan, H. U., & Ilyas, M. (2022) · IEEE Access · doi:10.1109/access.2022.3140181 · Cited by 105 · see citing works
Investigating and Designing for Trust in AI-powered Code Generation Tools
Wang, R., Cheng, R., Ford, D., & Zimmermann, T. (2024) · The 2024 ACM Conference on Fairness, Accountability, and Transparency · doi:10.1145/3630106.3658984 · Cited by 87 · see citing works
“requirement for such tools, as it serves as a key prerequisite for the safety of resulting software products [23, 31, 42].”
BackgroundExtending the Agile Development Process to Develop Acceptably Secure Software
Othmane, L. B., Angın, P., Weffers, H., & Bhargava, B. (2014) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2014.2298011 · Cited by 79 · see citing works
Systematic Mapping Study on Security Approaches in Secure Software Engineering
Khan, R. A., Khan, S. U., Khan, H. U., & Ilyas, M. (2021) · IEEE Access · doi:10.1109/access.2021.3052311 · Cited by 74 · see citing works
Investigation of IS professionals’ intention to practise secure development of applications
Woon, I. M. Y., & Kankanhalli, A. (2006) · International Journal of Human-Computer Studies · doi:10.1016/j.ijhcs.2006.08.003 · Cited by 71 · see citing works
Survey and analysis on Security Requirements Engineering
Salini, P., & Kanmani, S. (2012) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2012.08.008 · Cited by 67 · see citing works
Shilton, K., & Greene, D. (2017) · Journal of Business Ethics · doi:10.1007/s10551-017-3504-8 · Cited by 59 · see citing works
Copiloting the future: How generative AI transforms Software Engineering
Banh, L., Holldack, F., & Strobel, G. (2025) · Information and Software Technology · doi:10.1016/j.infsof.2025.107751 · Cited by 66 · see citing works
Trusted computing and provenance: Better together
Lyle, J., & Martin, A. (2010) · Cited by 56 · see citing works
Iwaya, L. H., Babar, M. A., & Rashid, A. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3290237 · Cited by 51 · see citing works
Nicolaysen, T., Sassoon, R., Line, M. B., & Jaatun, M. G. (2010) · International Journal of Secure Software Engineering · doi:10.4018/jsse.2010070105 · Cited by 49 · see citing works
Attack surface definitions: A systematic literature review
Theisen, C., Munaiah, N., Al-Zyoud, M. M., Carver, J. C., Meneely, A., & Williams, L. A. (2018) · Information and Software Technology · doi:10.1016/j.infsof.2018.07.008 · Cited by 47 · see citing works
Towards a structured unified process for software security
Ardi, S., Byers, D., & Shahmehri, N. (2006) · International Workshop on Software Engineering for Secure Systems (SESS) · doi:10.1145/1137627.1137630 · Cited by 46 · see citing works
testar – scriptless testing through graphical user interface
Vos, T. E. J., Aho, P., Ricós, F. P., Rodríguez-Valdés, O., & Mulders, A. (2021) · Software Testing Verification and Reliability · doi:10.1002/stvr.1771 · Cited by 44 · see citing works
Modeling Software VulnerabilitiesWith Vulnerability Cause Graphs
Byers, D., Ardi, S., Shahmehri, N., & Duma, C. (2006) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsm.2006.40 · Cited by 44 · see citing works
Cheng, R., Wang, R., Zimmermann, T., & Ford, D. (2024) · ACM Transactions on Interactive Intelligent Systems · doi:10.1145/3651990 · Cited by 47 · see citing works
“Many strive to help developers form and maintain an appropriate level of trust in AI code generation tools—an insufficient level of trust can prevent developers from using AI to increase productivity [42, 48], while too much trust can lead to overlooking risks and safety vulnerabilities to software used by millions of…”
BackgroundMethodA Preventive Secure Software Development Model for a Software Factory: A Case Study
Núñez, J. C. S., Lindo, A. C., & Rodríguez, P. G. (2020) · IEEE Access · doi:10.1109/access.2020.2989113 · Cited by 40 · see citing works
Evaluating the cost reduction of static code analysis for software security
Baca, D., Carlsson, B., & Lundberg, L. (2008) · ACM Workshop on Programming Languages and Analysis for Security · doi:10.1145/1375696.1375707 · Cited by 39 · see citing works
Checking threat modeling data flow diagrams for implementation conformance and security
Abi-Antoun, M., Wang, D., & Torr, P. (2007) · doi:10.1145/1321631.1321692 · Cited by 38 · see citing works
Guidelines for secure software development
Futcher, L. A., & von Solms, R. (2008) · South African Institute of Computer Scientists and Information Technologists · doi:10.1145/1456659.1456667 · Cited by 38 · see citing works
The Trouble with Security Requirements
Türpe, S. (2017) · IEEE International Requirements Engineering Conference (RE) · doi:10.1109/re.2017.13 · Cited by 38 · see citing works
Ankele, R., Marksteiner, S., Nahrgang, K., & Vallant, H. (2019) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3339252.3341482 · Cited by 32 · see citing works
Design of a Process for Software Security
Byers, D., & Shahmehri, N. (2007) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2007.67 · Cited by 31 · see citing works
Secure Software Design in Practice
Meland, P. H., & Jensen, J. (2008) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2008.48 · Cited by 31 · see citing works
Al‐Fedaghi, S., & Alrashed, A. A. (2010) · IEEE International Conference on Communication Software and Networks · doi:10.1109/iccsn.2010.29 · Cited by 30 · see citing works
Systematic review of web application security development model
Shuaibu, B. M., Norwawi, N. M., Selamat, M. H., & Al-Alwani, A. (2013) · Artificial Intelligence Review · doi:10.1007/s10462-012-9375-6 · Cited by 30 · see citing works
Software security during modern code review: the developer’s perspective
Braz, L., & Bacchelli, A. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3549135 · Cited by 29 · see citing works
Evaluation of static analysis tools for software security
AlBreiki, H. H., & Mahmoud, Q. H. (2014) · International Conference on Innovations in Information Technology · doi:10.1109/innovations.2014.6987569 · Cited by 26 · see citing works
Systematic Review of Web Application Security Vulnerabilities Detection Methods
Rafique, S., Humayun, M., Gul, Z., Abbas, A., & Javed, H. (2015) · Journal of Computer and Communications · doi:10.4236/jcc.2015.39004 · Cited by 25 · see citing works
Secure Software Engineering Education: Knowledge Area, Curriculum and Resources
Yuan, X., Li, Y., Jones, B., Yu, H., & Chu, B.-T. B. (2016) · Journal of Cybersecurity Education Research and Practice · doi:10.62915/2472-2707.1004 · Cited by 25 · see citing works
Secure Software Development Life Cycle Processes: A Technology Scouting Report
Davis, N. (2018) · Figshare · doi:10.1184/r1/6583649 · Cited by 25 · see citing works
Covering Your Assets in Software Engineering
Jaatun, M. G., & Tøndel, I. A. (2008) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2008.8 · Cited by 24 · see citing works
Web Development Evolution: The Assimilation of Web Engineering Security
Glisson, W. B., & Welland, R. (2006) · Latin American Web Congress · doi:10.1109/laweb.2005.48 · Cited by 23 · see citing works
How can the developer benefit from security modeling?
Ardi, S., Byers, D., Meland, P. H., Tøndel, I. A., & Shahmehri, N. (2007) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2007.96 · Cited by 21 · see citing works
Khan, R. A., Akbar, M. A., Rafi, S., Almagrabi, A. O., & Alzahrani, M. (2023) · Journal of Software Evolution and Process · doi:10.1002/smr.2594 · Cited by 20 · see citing works
Secure Software Development Life Cycle Processes: A Technology Scouting Report
Ielloii, C. M. (2005) · Cited by 20 · see citing works
A Cause-Based Approach to Preventing Software Vulnerabilities
Byers, D., & Shahmehri, N. (2008) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2008.12 · Cited by 20 · see citing works
The State of the Art on Secure Software Engineering
Khan, R. A., Khan, S. U., Ilyas, M., & Idris, M. Y. (2020) · International Conference on Evaluation and Assessment in Software Engineering (EASE) · doi:10.1145/3383219.3383290 · Cited by 19 · see citing works
SecSDM: A Model for Integrating Security into the Software Development Life Cycle
Futcher, L. A., & von Solms, R. (2007) · IFIP advances in information and communication technology · doi:10.1007/978-0-387-73269-5_6 · Cited by 19 · see citing works
On the Effective Use of Security Test Patterns
Smith, B. H., & Williams, L. A. (2012) · doi:10.1109/sere.2012.23 · Cited by 19 · see citing works
Threat‐oriented security framework in risk management using multiagent system
Bedi, P., Gandotra, V., Singhal, A., Narang, H., & Sharma, S. K. (2012) · Software Practice and Experience · doi:10.1002/spe.2133 · Cited by 19 · see citing works
A Survey on Design Methods for Secure Software Development
Surakhi, O., Hudaib, A. A., Alshraideh, M., & Khanafseh, M. (2017) · INTERNATIONAL JOURNAL OF COMPUTERS & TECHNOLOGY · doi:10.24297/ijct.v16i7.6467 · Cited by 19 · see citing works
Alzahrani, A., & Khan, R. A. (2023) · Computers in Human Behavior · doi:10.1016/j.chb.2023.108109 · Cited by 18 · see citing works
Comparing Four Static Analysis Tools for Java Concurrency Bugs
Mamun, M. A. A., Khanam, A., Grahn, H., & FELDT, R. H. (2010) · Cited by 18 · see citing works
Systematizing security test case planning using functional requirements phrases
Smith, B. H. (2011) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/1985793.1986019 · Cited by 17 · see citing works
Munaiah, N., & Meneely, A. (2016) · ACM Workshop on Software Protection (SPRO) · doi:10.1145/2995306.2995311 · Cited by 17 · see citing works
Johnson, R. E., & Hafiz, M. (2010) · Cited by 16 · see citing works
Identifying Security Requirements Hybrid Technique
Gandotra, V., Singhal, A., & Bedi, P. (2009) · International Conference on Software Engineering Advances · doi:10.1109/icsea.2009.65 · Cited by 16 · see citing works
Threat modeling using formal methods: A new approach to develop secure web applications
Hussain, S., Erwin, H. R., & Dunne, P. (2011) · International Conference on Emerging Technologies · doi:10.1109/icet.2011.6048492 · Cited by 16 · see citing works
Blazakis, D. (2011) · Cited by 16 · see citing works
“A framework for development of secure software”
Chatterjee, K., Gupta, D. S., & Де, А. (2013) · CSI Transactions on ICT · doi:10.1007/s40012-013-0010-8 · Cited by 15 · see citing works
King, J., & Williams, L. A. (2014) · Symposium and Bootcamp on Science of Security · doi:10.1145/2600176.2600183 · Cited by 15 · see citing works
Mir, I. A., & Quadri, S. M. K. (2012) · International Journal of Computer Network and Information Security · doi:10.5815/ijcnis.2012.11.03 · Cited by 15 · see citing works
Static Security Analysis Based on Input-Related Software Faults
Nagy, C., & Mancoridis, S. (2009) · Euromicro Conference on Software Maintenance and Reengineering (CSMR) · doi:10.1109/csmr.2009.51 · Cited by 15 · see citing works
A Survey on Requirements and Design Methods for Secure Software Development
Umair, M., Khan, A., & Zulkernine, M. (2009) · Cited by 15 · see citing works
Teaching secure coding for beginning programmers
Williams, K., Yuan, X., Yu, H., & Bryant, K. S. (2014) · Journal of computing sciences in colleges · doi:10.5555/2600623.2600641 · Cited by 15 · see citing works
Natural Language Insights from Code Reviews that Missed a Vulnerability
Munaiah, N., Meyers, B. S., Alm, C. O., Meneely, A., Murukannaiah, P. K., Prud’hommeaux, E. T., Wolff, J., & Yu, Y. (2017) · Lecture notes in computer science · doi:10.1007/978-3-319-62105-0_5 · Cited by 15 · see citing works
Systems and Software Engineering— Systems and Software Assurance— Part 1: Concepts and Vocabulary
Std, I. (2011) · Cited by 14 · see citing works
Enforcing Policy-Based Security Models for Embedded SoCs within the Internet of Things
Hagan, M., Siddiqui, F. M., Sezer, S., Kang, B., & McLaughlin, K. (2018) · IEEE Conference on Dependable and Secure Computing (DSC) · doi:10.1109/desec.2018.8625140 · Cited by 14 · see citing works
Türpe, S., Kocksch, L., & Poller, A. (2022) · Fraunhofer-Publica (Fraunhofer-Gesellschaft) · doi:10.24406/publica-fhg-395907 · Cited by 14 · see citing works
A case for the economics of secure software development
Heitzenrater, C., & Simpson, A. C. (2016) · New Security Paradigms Workshop · doi:10.1145/3011883.3011884 · Cited by 14 · see citing works
Activity and Artifact Views of a Secure Software Development Process
Khan, M. U., & Zulkernine, M. (2009) · doi:10.1109/cse.2009.383 · Cited by 13 · see citing works
Secure Software Engineering: A New Teaching Perspective Based on the SWEBOK
Ormandjieva, O., Khelifi, A., & Jololian, L. (2010) · Interdisciplinary Journal of Information Knowledge and Management · doi:10.28945/1125 · Cited by 13 · see citing works
Trust-based specification of sociotechnical systems
Paja, E., Chopra, A. K., & Giorgini, P. (2012) · Data & Knowledge Engineering · doi:10.1016/j.datak.2012.12.005 · Cited by 13 · see citing works
Maass, M., Scherlis, W. L., & Aldrich, J. (2014) · Symposium and Bootcamp on Science of Security · doi:10.1145/2600176.2600177 · Cited by 12 · see citing works
A model based security requirements engineering framework applied for online trading system
Salini, P., & Kanmani, S. (2011) · International Conference on Recent Trends in Information Technology · doi:10.1109/icrtit.2011.5972266 · Cited by 12 · see citing works
Yi, Q., Xiong, S., Wang, B., & Yi, S. (2020) · International Journal of Industrial Ergonomics · doi:10.1016/j.ergon.2019.102903 · Cited by 12 · see citing works
An Overview of Penetration Testing
Phong, C. T., & Yan, W. Q. (2014) · International Journal of Digital Crime and Forensics · doi:10.4018/ijdcf.2014100104 · Cited by 12 · see citing works
Towards analyzing complex operating system access control configurations
Chen, H., Li, N., Gates, C. S., & Mao, Z. (2010) · ACM Symposium on Access Control Models and Technologies (SACMAT) · doi:10.1145/1809842.1809848 · Cited by 12 · see citing works
Expediting the design and development of secure cloud-based mobile apps
Chimuco, F. T., Sequeiros, J. B. F., Simões, T. M. C., Freire, M. M., & Inácio, P. R. M. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00880-6 · Cited by 14 · see citing works
Sociotechnical Trust: An Architectural Approach
Chopra, A. K., Paja, E., Giorgini, P., & Chopra, A. K. (2011) · Cited by 11 · see citing works
Promotion of secure software development assimilation: stimulating individual motivation
Song, M., Penghua, W., & Yang, P. (2018) · Chinese Management Studies · doi:10.1108/cms-01-2017-0005 · Cited by 11 · see citing works
Security Requirements and Tests for Smart Toys
de Carvalho, L. G., & Eler, M. M. (2018) · Lecture notes in business information processing · doi:10.1007/978-3-319-93375-7_14 · Cited by 11 · see citing works
Bayesian-model averaging using MCMCBayes for web-browser vulnerability discovery
Johnston, R., Sarkani, S., Mazzuchi, T. A., Holzer, T. H., & Eveleigh, T. (2018) · Reliability Engineering & System Safety · doi:10.1016/j.ress.2018.11.030 · Cited by 11 · see citing works
Computer Viruses and Other Malicious Software
OECD (2009) · OECD eBooks · doi:10.1787/9789264056510-en · Cited by 11 · see citing works
Mitigating the authentication vulnerabilities in Web applications through security requirements
Kumar, R. (2011) · World Congress on Information and Communication Technologies · doi:10.1109/wict.2011.6141435 · Cited by 11 · see citing works
Towards a Comprehensive View of Secure Software Engineering
Essafi, M., Jilani, L. L., & Ghézala, H. B. (2007) · International Conference on Emerging Security Information, Systems and Technologies · doi:10.1109/secureware.2007.4385331 · Cited by 11 · see citing works
Exploring Security Procedures in Secure Software Engineering: A Systematic Mapping Study
Khan, R. A., Khan, S. U., & Ilyas, M. (2022) · International Conference on Evaluation and Assessment in Software Engineering (EASE) · doi:10.1145/3530019.3531336 · Cited by 10 · see citing works
Blockchain-based model for tracking compliance with security requirements
Marjanović, J., Dalčeković, N., & Sladić, G. (2022) · Computer Science and Information Systems · doi:10.2298/csis210923060m · Cited by 10 · see citing works
Independent Security Testing on Agile Software Development: A Case Study in a Software Company
Choliz, J., Vilas, J., & Moreira, J. E. (2015) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2015.79 · Cited by 10 · see citing works
Threat Mitigation, Monitoring and Management Plan - A New Approach in Risk Management
Gandotra, V., Singhal, A., & Bedi, P. (2009) · International Conference on Advances in Recent Technologies in Communication and Computing (ARTCom) · doi:10.1109/artcom.2009.38 · Cited by 10 · see citing works
A dataset for identifying actionable feedback in collaborative software development
Meyers, B. S., Munaiah, N., Prud’hommeaux, E. T., Meneely, A., Wolff, J., Alm, C. O., & Murukannaiah, P. K. (2018) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p18-2021 · Cited by 10 · see citing works
Characterization of User-Centered Security in Telehealth Services
Vega-Barbas, M., Seoane, F., & Pau, I. (2019) · International Journal of Environmental Research and Public Health · doi:10.3390/ijerph16050693 · Cited by 9 · see citing works
Security Requirements Prioritization Based on Threat Modeling and Valuation Graph
Park, K., Yoo, S. G., & Kim, J. (2011) · Communications in computer and information science · doi:10.1007/978-3-642-24106-2_19 · Cited by 10 · see citing works
Ahmed, S. R. (2007) · KTH Publication Database DiVA (KTH Royal Institute of Technology) · Cited by 10 · see citing works
Comparing Detection Ratio of Three Static Analysis Tools
Brar, H. K., & Jai, P. (2015) · International Journal of Computer Applications · doi:10.5120/ijca2015905749 · Cited by 9 · see citing works
A step towards Secure Software System using fuzzy logic
Gandotra, V., Singhal, A., & Bedi, P. (2010) · International Conference on Computer Engineering and Technology · doi:10.1109/iccet.2010.5486061 · Cited by 9 · see citing works
Security requirements identification and prioritization for smart toys
de Carvalho, L. G., Fantinato, M., & Eler, M. M. (2020) · Electronic Commerce Research and Applications · doi:10.1016/j.elerap.2020.100972 · Cited by 9 · see citing works
Prioritisation and Selection of Software Security Activities
Byers, D., & Shahmehri, N. (2009) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1109/ares.2009.52 · Cited by 9 · see citing works
Detecting buffer overflows using testcase synthesis and code instrumentation
Zhivich, M. (2005) · DSpace@MIT (Massachusetts Institute of Technology) · Cited by 9 · see citing works
Lipner, S. B. (2015) · Communications of the ACM · doi:10.1145/2822513 · Cited by 8 · see citing works
Self-citationEvaluation of Engineering Approaches in the Secure Software Development Life Cycle
Busch, M., de Koch, N. P., & Wirsing, M. (2014) · Lecture notes in computer science · doi:10.1007/978-3-319-07452-8_10 · Cited by 8 · see citing works
STAMP S&S: Safety & Security Scenario for Specification and Standard in the society of AI/IoT
Kaneko, T., Yoshioka, N., & Sasaki, R. (2020) · IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) · doi:10.1109/qrs-c51114.2020.00037 · Cited by 8 · see citing works
Penetration Testing Security Tools: A Comparison
Anand, P., & Singh, A. S. (2021) · International Conference on System Modeling & Advancement in Research Trends (SMART) · doi:10.1109/smart52563.2021.9676283 · Cited by 8 · see citing works
Web Engineering Security (WES) Methodology
Glisson, W. B., & Welland, R. (2014) · Communications of the Association for Information Systems · doi:10.17705/1cais.03471 · Cited by 8 · see citing works
- Authors
- Lipner, S.
- Affiliations
- Microsoft (United States) (US)
- Corresponding author
- Lipner, S.
- Venue
- 20th Annual Computer Security Applications Conference
- Publisher
- IEEE
- Published
- 2005-04-06
- Pages
- 2-13
- ISSN
- 1063-9527 (ISSN-L)
- OpenAlex
- W1604658196
- Cited by
- 234
- References
- 0
- Citations by year
- 2026: 3 · 2025: 6 · 2024: 7 · 2023: 8 · 2022: 8 · 2021: 8 · 2020: 11 · 2019: 5 · 2018: 13 · 2017: 7 · 2016: 6 · 2015: 16 · 2014: 21 · 2013: 16 · 2012: 12
- FWCI
- 10.23
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Annual Computer Security Applications Conference (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Keywords
- security development lifecycle, trustworthy computing, Microsoft, threat modeling, static code analysis, code review, security testing, software vulnerabilities, software development process
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
