Rapid Application Development / Advanced Excel Development

Security

• Is everybody's concern
• Spreadsheets can be used as a staging board for privilege escalation (with your login details!)
• Consider SD3 +C
  • Secure by
  • Design
  • Default
  • Deployment
  • Communication
• Threat Modeling- Assets, Threats
• Threat Types - STRIDE
  • (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
• Threats - rate with DREAD
  • (Damage potential, Reproducibility, Exploitability, Affected Users, Discoverability)
• Spreadsheets (all flavours) are fairly insecure
• Compiled UDFs (.net, COM, XLL) and Database servers can help
• Set macro security to high and use code signing certificates.
• See Microsoft MOC 2840A - Implementing security for more info.