Link copied to clipboard! Threats intelligence Influence operations Threat intelligence This article in our series focused on Microsoft’s free security tools is on the Security Development Lifecycle (SDL) banned.h header file. This is an important tool for developers who are trying to minimize the number of security vulnerabilities that exist in the C or C++ code they write. It’s also important for IT Professionals to know about this tool as they can ask the ISVs and developers of the applications they deploy and operate in their environments whether they were developed using banned.h. The banned.h header file is a sanitizing resource that is designed to help developers avoid using and help identify and remove banned functions from code that may lead to vulnerabilities. Banned functions are those calls in code that have been deemed dangerous by making it relatively easy to introduce vulnerabilities into code during development. For example, if a developer decided to use the strcpy function in his/her code, using banned.h in the same application will generate error(s) when its recompiled telling the developer that strcpy has been deprecated. When the developer investigates why the error is being generated, they will likely figure out that strcpy has been replaced with a more secure version called strcpy_s , that makes it more difficult to make mistakes that lead to simple buffer overflows. Any code that is exposed to the internet or is used to process personally identifiable information should be verified to see if banned application programming interfaces (APIs) are present. By removing banned APIs, developers can help minimize an application’s risk exposure and ultimately improve the customer experience. Banned.h is designed to provide a list of all banned APIs so that developers can quickly locate them in the code and address each accordingly. To illustrate how banned.h works, I’ve provide a screen shot below of an application loaded into a compiler using banned.h. In this example we have inserted the following code (circled in Red): #include “banned.h” Then by recompiling the code we can see which APIs have been banned by the Microsoft Security Development Lifecycle. In the example above, we can see the banned APIs in the Output box highlighted in Red at the bottom of the screen shot. Existing code that has banned APIs identified should either be replaced with a more secure version or re-architected so that the banned function is not used.

If you are interested in learning more about the Security Development Lifecycle Banned.h header file, I encourage you to check out these resources: Tim Rains Director, Trustworthy Computing September 2 16 min read Impersonating IT support: how threat actors turn a remote session into enterprise-wide access Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node. Impersonating IT support: how threat actors turn a remote session into enterprise-wide access September 1 18 min read Counterfeit installers to system compromise: Tracking a deceptive software download campaign An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Counterfeit installers to system compromise: Tracking a deceptive software download campaign September 1 4 min read Cybersecurity IR Workshop: The workshop you shouldn’t miss Cyber resilience starts before a crisis. Gain practical insights from DART to strengthen readiness and response. Cybersecurity IR Workshop: The workshop you shouldn’t miss Get started with Microsoft Security Protect your people, data, and infrastructure with AI-powered, end-to-end security from Microsoft. Connect with us on social