Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL

How do you keep a secure development lifecycle useful as products, teams, and delivery methods change? Glenn Leifheit joins Chris and Robert to share lessons from Microsoft’s SDL and its evolution beyond a rigid sequence of security tasks. He explains the importance of adapting the program to a product’s context, treating developers as customers, and making security help easy to access. The conversation covers community, practical learning, constraints that encourage creative solutions, and the need to evolve alongside development practices. Glenn also describes mentoring across roles and seeking ideas outside the security industry. His central message is that a sustainable SDL depends on partnership and repeatable habits, with processes simple enough to survive staffing changes and the pressures of everyday delivery.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Glenn Leifheit:
→ Glenn Leifheit on LinkedIn

Mentioned in this episode:
→ Microsoft Security Development Lifecycle (SDL)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Inside the Microsoft SDL with Glenn Leifheit
02:48 Where the SDL came from
10:54 Adapting security to the product and business
13:55 Making developers want to ask for help
23:35 Evolving the SDL with development practices
31:36 Learning from constraints and outside influences
34:54 Treating developers as customers
35:30 Building a learning community
38:56 Mentoring across roles and experience levels
42:42 Learning from organizations outside security
46:28 Making security processes sustainable
47:07 Partnership, adaptability, and practical next steps