--- title: Security (Not to be mistaken for Software) Development LifeCycle and Visual Studio - Team Foundation Server (VS-TFS) description: Security (Not to be mistaken for Software) Development LifeCycle and Visual Studio - Team Foundation Server (VS-TFS) image: https://blogs.incyclesoftware.com/hs-fs/file-3472675575-jpg/blog-files/clip_image002_thumb1.jpg --- # Security (Not to be mistaken for Software) Development LifeCycle and Visual Studio - Team Foundation Server (VS-TFS) Posted by Frederic Persoon - October 30, 2012 - [**](https://www.facebook.com/sharer/sharer.php?u=https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/) - [**](https://www.linkedin.com/shareArticle?mini=true&url=https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/&title=&summary=&source=) - [**](https://twitter.com/home?status=) - [**](mailto:?&subject=https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/&body=https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/) ** ![header-picture](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/woman-notebook-working-girl.png "header-picture") I was recently asked by one of our customer to talk about SDL and VS-TFS, I thought I would share a synopsis of the roundtable with you…Feel free to ping me if you have questions. In 2011, Honda was hit by 283,000 unauthorized data access and lost $206 million in lawsuits, RSA security had to reimburse $66 Million. Sony, ADP, Google, Nasdaq and many others are examples of companies being hit on a regular basis with various impacts. In fact, information from [various](http://www.isaca.com) [studies](http://krebsonsecurity.com/2011/10/who-else-was-hit-by-the-rsa-attackers/) suggests that more than 760 other organizations** **had networks that were compromised with some of the same resources used to hit RSA. Almost 20 percent of the current Fortune 100** **companies are on this list. Many rules were put in place overtime to try to prevent some of those issues, and others, such as SOX, SB1386, ISO27001, BS7799, FISMA & NIST, PCI-DSS/OWASP, SEC, [etc](http://csrc.nist.gov/groups/SMA/fisma/index.html). One of the common threats is against insecure applications: • 90% of attacks are at the application layer (Verizon Business Study) • Hacks targeting retail sector have increased 43%, largely due to SQL injection and the use of exploit toolkits (Dell SecureWorks) • 25% of respondents indicated that meeting compliance objectives is the most effective argument in convincing management to invest in software security (Forrester) • 92% of attacks were not highly difficult (Verizon Business Study) • Use of Hard-coded Credentials is still in the [top 10](https://www.owasp.org/index.php/Top_10_2010-Main) of the [**Most Dangerous**](http://cwe.mitre.org/top25/)** Software Errors** And as other [studies](http://www.microsoft.com/en-us/download/details.aspx?id=2629) suggest, not much is done about it: [![clip_image002](https://blogs.incyclesoftware.com/hs-fs/file-3472675575-jpg/blog-files/clip_image002_thumb1.jpg?width=962&height=395&name=clip_image002_thumb1.jpg)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0021.jpg) So, where to start? [![clip_image004](https://blogs.incyclesoftware.com/hs-fs/file-3472675585-jpg/blog-files/clip_image004_thumb1.jpg?width=970&height=366&name=clip_image004_thumb1.jpg)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0041.jpg) As for any change management project, we need to change people, process and tools: **People** · Implement new roles (e.g. Audit) and accountability · Train and coach · Align Governance-Security-Dev-QA-Ops Roles **Process** · Implement SDL · Establish requirements · Perform reviews · Tools/Technologies **Leverage MS Stack (VS-TFS-SP-PPS)** · Code Analysis · Work management (Process, documentation, etc.) · Governance-Security-Dev-QA-Ops Work Alignment · Automation The good news is that the overall improvement process can be supported by Microsoft and VS-TFS. Indeed, as a pioneer in the field, the company developed the [SDL process](http://www.microsoft.com/security/sdl/default.aspx) in the late 1999 and made it mandatory in 2004, it’s called the Secure Windows Initiative. This maturity model can support the implementation of the various steps required to make your applications secure. Let’s focus on the tools; various [technical components](http://www.microsoft.com/security/sdl/adopt/tools.aspx) have been included in Visual Studio and Team Foundation server: [![clip_image006](https://blogs.incyclesoftware.com/hs-fs/file-3472675595-png/blog-files/clip_image006_thumb1.png?width=976&height=271&name=clip_image006_thumb1.png)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0061.png) One of those components is the [TFS template](http://msdn.microsoft.com/library/ee790621.aspx) (currently 2008 and 2010), which among other things, includes new check-in rules, automated creation of specific tasks and reporting. [![clip_image008](https://blogs.incyclesoftware.com/hs-fs/file-3472675605-jpg/blog-files/clip_image008_thumb1.jpg?width=1007&height=556&name=clip_image008_thumb1.jpg)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0081.jpg) [![clip_image010](https://blogs.incyclesoftware.com/hs-fs/file-3472675615-jpg/blog-files/clip_image010_thumb1.jpg?width=1005&height=534&name=clip_image010_thumb1.jpg)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0101.jpg) [![clip_image012](https://blogs.incyclesoftware.com/hs-fs/file-3472675625-jpg/blog-files/clip_image012_thumb1.jpg?width=1014&height=408&name=clip_image012_thumb1.jpg)](http://incycle-corpweb.azurewebsites.net/wp-content/uploads/2012/10/clip_image0121.jpg) The tooling is just a piece of what the SDL maturity framework includes, some practices, like automating static code analysis at build time and doing thread modeling using the Elevation of Privilege (EoP) Card Game (think serious game like planning poker) as well as fuzz testing are also included, and are very well documented. So, in conclusion, treat Software Security as a LifeCycle process, not in a piecemeal fashion. Applying change management concepts along the way, such as *baby steps* approach (Define impact vs. maturity, remediation vs. new code), focusing on the accuracy of the output at each stage, implementing proactive security practices, aligning the various organizations (dev, security, business, QA, etc.), defining as well as measuring objectives and leveraging the tools to support your improvement process. Topics: [Blog](https://blogs.incyclesoftware.com/topic/blog) --- ### Recent Posts By InCycle - 30 October, 2012 #### InCycle Wins Prestigious Microsoft Global Partner of the Year Award [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/incycle-wins-prestigious-microsoft-global-partner-of-the-year-award) By InCycle - 30 October, 2012 #### Top 5 Questions On Elevate for App Modernization [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/top-five-questions-on-elevate-for-app-modernization) By InCycle - 30 October, 2012 #### GitHub Universe 2025 Top Announcements [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/github-universe-2025-top-announcements) --- ### Subscribe to Blog ### ![2025 Microsoft Partner of the Year Winner: InCycle Software](https://blogs.incyclesoftware.com/hs-fs/hubfs/InCycle%202025%20Microsoft%20PoY%20Badge.png?width=377&height=223&name=InCycle%202025%20Microsoft%20PoY%20Badge.png) ### About this blog Since 2002, InCycle has been providing challenging thought leadership to help customers successfully combine modern application designs, IT platforms and DevOps practices to achieve new levels of success. As a leader in app modernization, these blogs are written by our expert consultants and provide useful information to help on your journey to the cloud and better software. Happy reading! ### Platform Engineering Webinar on Demand PE deep dive and demo! [![Learn More!](https://no-cache.hubspot.com/cta/default/707613/aae0556f-2d26-4ce4-9b32-e7bebd443c9a.png)](https://cta-redirect.hubspot.com/cta/redirect/707613/aae0556f-2d26-4ce4-9b32-e7bebd443c9a) ### Recent Posts ### Migrating to GitHub? Start with a GitHub Migration Strategy and Roadmap (at no cost!) [![Learn More!](https://no-cache.hubspot.com/cta/default/707613/312dc03f-1f78-4907-aaaf-3c0aa3cccd8f.png)](https://cta-redirect.hubspot.com/cta/redirect/707613/312dc03f-1f78-4907-aaaf-3c0aa3cccd8f) ### Posts by Topic - [Blog (194)](https://blogs.incyclesoftware.com/topic/blog) - [Video (32)](https://blogs.incyclesoftware.com/topic/video) - [Azure (25)](https://blogs.incyclesoftware.com/topic/azure) - [DevOps (20)](https://blogs.incyclesoftware.com/topic/devops) - [GitHub (13)](https://blogs.incyclesoftware.com/topic/github) - [InRelease (12)](https://blogs.incyclesoftware.com/topic/inrelease) - [Containers (11)](https://blogs.incyclesoftware.com/topic/containers) - [release management (11)](https://blogs.incyclesoftware.com/topic/release-management) - [AKS (10)](https://blogs.incyclesoftware.com/topic/aks) - [CI/CD (10)](https://blogs.incyclesoftware.com/topic/ci-cd) - [Kubernetes (10)](https://blogs.incyclesoftware.com/topic/kubernetes) - [Azure DevOps (9)](https://blogs.incyclesoftware.com/topic/azure-devops) - [Migration (9)](https://blogs.incyclesoftware.com/topic/migration) - [Platform Engineering (PE) (9)](https://blogs.incyclesoftware.com/topic/platform-engineering-pe) - [GenAI (8)](https://blogs.incyclesoftware.com/topic/genai) - [Microsoft Azure (8)](https://blogs.incyclesoftware.com/topic/microsoft-azure) - [Visual Studio (8)](https://blogs.incyclesoftware.com/topic/visual-studio) - [tfs (8)](https://blogs.incyclesoftware.com/topic/tfs) - [Awards (7)](https://blogs.incyclesoftware.com/topic/awards) - [Big Data (6)](https://blogs.incyclesoftware.com/topic/big-data) - [Innovation (6)](https://blogs.incyclesoftware.com/topic/innovation) - [Microsoft (6)](https://blogs.incyclesoftware.com/topic/microsoft) - [agile (6)](https://blogs.incyclesoftware.com/topic/agile) - [vsts (6)](https://blogs.incyclesoftware.com/topic/vsts) - [Data (5)](https://blogs.incyclesoftware.com/topic/data) - [Modernization (5)](https://blogs.incyclesoftware.com/topic/modernization) - [App Modernization (4)](https://blogs.incyclesoftware.com/topic/app-modernization) - [Automated Testing (4)](https://blogs.incyclesoftware.com/topic/automated-testing) - [Data & AI (4)](https://blogs.incyclesoftware.com/topic/data-ai) - [Event (4)](https://blogs.incyclesoftware.com/topic/event) - [MLOps (4)](https://blogs.incyclesoftware.com/topic/mlops) - [Modern Apps (4)](https://blogs.incyclesoftware.com/topic/modern-apps) - [Visual Studio 2017 (4)](https://blogs.incyclesoftware.com/topic/visual-studio-2017) - [DevTest (3)](https://blogs.incyclesoftware.com/topic/devtest) - [Events (3)](https://blogs.incyclesoftware.com/topic/events) - [Governance (3)](https://blogs.incyclesoftware.com/topic/governance) - [VSO (3)](https://blogs.incyclesoftware.com/topic/vso) - [Data Analytics (2)](https://blogs.incyclesoftware.com/topic/data-analytics) - [Docker (2)](https://blogs.incyclesoftware.com/topic/docker) - [Integration (2)](https://blogs.incyclesoftware.com/topic/integration) - [Microsoft Connect (2)](https://blogs.incyclesoftware.com/topic/microsoft-connect) - [Mobile Development (2)](https://blogs.incyclesoftware.com/topic/mobile-development) - [RM (2)](https://blogs.incyclesoftware.com/topic/rm) - [SQL (2)](https://blogs.incyclesoftware.com/topic/sql) - [SaaS (2)](https://blogs.incyclesoftware.com/topic/saas) - [TFS 15 Preview (2)](https://blogs.incyclesoftware.com/topic/tfs-15-preview) - [TFS 2017 (2)](https://blogs.incyclesoftware.com/topic/tfs-2017) - [Uncategorized (2)](https://blogs.incyclesoftware.com/topic/uncategorized) - [Visual Studio 2015 (2)](https://blogs.incyclesoftware.com/topic/visual-studio-2015) - [Xamarin (2)](https://blogs.incyclesoftware.com/topic/xamarin) - [ADX (1)](https://blogs.incyclesoftware.com/topic/adx) - [AI (1)](https://blogs.incyclesoftware.com/topic/ai) - [Android (1)](https://blogs.incyclesoftware.com/topic/android) - [Application Monitoring (1)](https://blogs.incyclesoftware.com/topic/application-monitoring) - [Apps (1)](https://blogs.incyclesoftware.com/topic/apps) - [BI (1)](https://blogs.incyclesoftware.com/topic/bi) - [Brian Harry (1)](https://blogs.incyclesoftware.com/topic/brian-harry) - [Cloud Azure (1)](https://blogs.incyclesoftware.com/topic/cloud-azure) - [Cloud Services (1)](https://blogs.incyclesoftware.com/topic/cloud-services) - [Connect (1)](https://blogs.incyclesoftware.com/topic/connect) - [Connect 2016 (1)](https://blogs.incyclesoftware.com/topic/connect-2016) - [Consultants (1)](https://blogs.incyclesoftware.com/topic/consultants) - [Cosmos DB (1)](https://blogs.incyclesoftware.com/topic/cosmos-db) - [Data Center (1)](https://blogs.incyclesoftware.com/topic/data-center) - [Development (1)](https://blogs.incyclesoftware.com/topic/development) - [EA (1)](https://blogs.incyclesoftware.com/topic/ea) - [Git (1)](https://blogs.incyclesoftware.com/topic/git) - [Hybrid (1)](https://blogs.incyclesoftware.com/topic/hybrid) - [IntelliTes (1)](https://blogs.incyclesoftware.com/topic/intellites) - [IntelliTest (1)](https://blogs.incyclesoftware.com/topic/intellitest) - [Lab Management (1)](https://blogs.incyclesoftware.com/topic/lab-management) - [Live Unit Testing (1)](https://blogs.incyclesoftware.com/topic/live-unit-testing) - [Load Testing (1)](https://blogs.incyclesoftware.com/topic/load-testing) - [MSDN (1)](https://blogs.incyclesoftware.com/topic/msdn) - [MSTest (1)](https://blogs.incyclesoftware.com/topic/mstest) - [MTM (1)](https://blogs.incyclesoftware.com/topic/mtm) - [Machine Learning (1)](https://blogs.incyclesoftware.com/topic/machine-learning) - [Media & Entertainment (1)](https://blogs.incyclesoftware.com/topic/media-entertainment) - [Microsoft Visual Studio (1)](https://blogs.incyclesoftware.com/topic/microsoft-visual-studio) - [Microsoft nationally managed partner (1)](https://blogs.incyclesoftware.com/topic/microsoft-nationally-managed-partner) - [NUnit (1)](https://blogs.incyclesoftware.com/topic/nunit) - [OpsHub (1)](https://blogs.incyclesoftware.com/topic/opshub) - [PaaS (1)](https://blogs.incyclesoftware.com/topic/paas) - [Pipelines (1)](https://blogs.incyclesoftware.com/topic/pipelines) - [PowerShell (1)](https://blogs.incyclesoftware.com/topic/powershell) - [Principles and Practices of DevOps (1)](https://blogs.incyclesoftware.com/topic/principles-and-practices-of-devops) - [Programs (1)](https://blogs.incyclesoftware.com/topic/programs) - [RC (1)](https://blogs.incyclesoftware.com/topic/rc) - [Release Candidate (1)](https://blogs.incyclesoftware.com/topic/release-candidate) - [SQL Databases (1)](https://blogs.incyclesoftware.com/topic/sql-databases) - [SQL server (1)](https://blogs.incyclesoftware.com/topic/sql-server) - [SSDT (1)](https://blogs.incyclesoftware.com/topic/ssdt) - [Software (1)](https://blogs.incyclesoftware.com/topic/software) - [Subscription & Billing Management (1)](https://blogs.incyclesoftware.com/topic/subscription-billing-management) - [TFS 15 (1)](https://blogs.incyclesoftware.com/topic/tfs-15) - [TFS 2015 update (1)](https://blogs.incyclesoftware.com/topic/tfs-2015-update) - [TFS 2016 (1)](https://blogs.incyclesoftware.com/topic/tfs-2016) - [TFS ALM (1)](https://blogs.incyclesoftware.com/topic/tfs-alm) - [TestMethods (1)](https://blogs.incyclesoftware.com/topic/testmethods) - [UI (1)](https://blogs.incyclesoftware.com/topic/ui) - [UX (1)](https://blogs.incyclesoftware.com/topic/ux) - [VS2017 (1)](https://blogs.incyclesoftware.com/topic/vs2017) - [Validation (1)](https://blogs.incyclesoftware.com/topic/validation) - [Virtual Machines (1)](https://blogs.incyclesoftware.com/topic/virtual-machines) - [WPC 2016 (1)](https://blogs.incyclesoftware.com/topic/wpc-2016) - [Web (1)](https://blogs.incyclesoftware.com/topic/web) - [Windows (1)](https://blogs.incyclesoftware.com/topic/windows) - [World Partner Conference (1)](https://blogs.incyclesoftware.com/topic/world-partner-conference) - [XUnit (1)](https://blogs.incyclesoftware.com/topic/xunit) - [alm (1)](https://blogs.incyclesoftware.com/topic/alm) - [automation (1)](https://blogs.incyclesoftware.com/topic/automation) - [build (1)](https://blogs.incyclesoftware.com/topic/build) - [code (1)](https://blogs.incyclesoftware.com/topic/code) - [nationally managed partner (1)](https://blogs.incyclesoftware.com/topic/nationally-managed-partner) - [sql server 2008 (1)](https://blogs.incyclesoftware.com/topic/sql-server-2008) - [unit testing (1)](https://blogs.incyclesoftware.com/topic/unit-testing) - [vm (1)](https://blogs.incyclesoftware.com/topic/vm) [see all](https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/#) ### Blog Archive - [November 2012 (17)](https://blogs.incyclesoftware.com/archive/2012/11) - [September 2025 (14)](https://blogs.incyclesoftware.com/archive/2025/09) - [October 2014 (12)](https://blogs.incyclesoftware.com/archive/2014/10) - [July 2012 (10)](https://blogs.incyclesoftware.com/archive/2012/07) - [October 2012 (9)](https://blogs.incyclesoftware.com/archive/2012/10) - [**](https://twitter.com/incyclesoftware?lang=en) - [**](https://ca.linkedin.com/company/incycle-software) - [**](https://www.facebook.com/InCycleSoftware/) ### About us At InCycle, we believe there is always a better way and today, that includes the cloud. [![InCycle Microsoft Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Incycle%202017%20website%20resources/logo-InCycle-New-white.png?width=200&name=logo-InCycle-New-white.png "InCycle Microsoft Partner")](https://www.incyclesoftware.com/) ### Learn more - [Why Incycle?](https://www.incyclesoftware.com/why-incycle) - [Success Stories](https://www.incyclesoftware.com/customer-success-stories) - [Events](https://www.incyclesoftware.com/events) - [Careers](https://www.incyclesoftware.com/careers) - [About](https://www.incyclesoftware.com/about-incycle-software)   ### 1-800-565-0510 [info@incyclesoftware.com](mailto:info@incyclesoftware.com)  ### ![Microsoft GitHub Verified Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/GitHub%20Verified%20Partner%20-%20white-SQUARE.png?width=256&height=57&name=GitHub%20Verified%20Partner%20-%20white-SQUARE.png) ![Data & AI Solutions Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Data%20%26%20AI%20Solutions%20Partner.png?width=125&height=144&name=Data%20%26%20AI%20Solutions%20Partner.png) ![Digital & App Innovation Solutions Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Digital%20%26%20App%20Innovation%20Solutions%20Partner.png?width=125&height=144&name=Digital%20%26%20App%20Innovation%20Solutions%20Partner.png)   © 2025 InCycle Software [Privacy policy](https://www.incyclesoftware.com/privacy) ** ![](https://px.ads.linkedin.com/collect/?pid=302756&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=302756&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Frederic Persoon", "url" : "https://blogs.incyclesoftware.com/author/frederic-persoon" }, "datePublished" : "2012-10-30T09:05:14.000Z", "headline" : "Security (Not to be mistaken for Software) Development LifeCycle and Visual Studio - Team Foundation Server (VS-TFS)", "image" : [ "https://blogs.incyclesoftware.com/hs-fs/file-3472675575-jpg/blog-files/clip_image002_thumb1.jpg" ], "mainEntityOfPage" : { "@id" : "https://blogs.incyclesoftware.com/2012/10/security-not-to-be-mistaken-for-software-development-lifecycle-and-visual-studio-team-foundation-server-vs-tfs-3/", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blogs.incyclesoftware.com/hubfs/logo-InCycle-New-Blue---transparent.png" }, "name" : "InCycle Software Inc." } } ```