Microsoft releases a new software security tool

PanARMENIAN.Net - Microsoft has released a new software tool to help developers write secure applications by highlighting the system changes created when their wares are installed on Windows machines.

The Attack Surface Analyzer, released on Jan. 18, is a free verification tool that analyzes the changes in system state, runtime parameters and securable objects in the Windows operating system. The tool, which was released as part of Microsoft's Secure Development Lifecycle, takes snapshots of a system and compares the results before and after an app is installed. It then identifies resulting classes of security weaknesses.

“The tool also gives an overview of the changes to the system Microsoft considers important to the security of the platform and highlights these in the attack surface report,” David Ladd, Microsoft's principal security program manager, blogged. Among the checks performed are analysis of changed or newly added files, registry keys, services, ActiveX controls, listening ports, and access control lists. It's available for free, for now as a beta so that Microsoft can collect feedback from users.

Attack Surface Analyzer was one of several security tools Microsoft released at the Black Hat Security Conference in Washington, DC. Redmond also published the next version of its SDL Threat Modeling Tool that's used to assess whether applications under development meet security and privacy guidelines. It now works with Microsoft Visio 2010.