Code Review During Planning and Design and Application and Development

Code Review During Planning and Design and Application and Development

Code Review During Planning and Design

While a security review of the architecture and threat modeling are not security testing methods, they are an important prerequisite for subsequent security testing efforts, and the security professional should be aware of the options available to them.

The following is a consideration of the prerequisites and benefits of architecture security review and threat modeling.

These methods help to identify the attack surface and, thus, the most critical components. This allows a focusing of the security testing activities to ensure they are as effective as possible.

A manual review of the product architecture to ensure that it fulfills the necessary security requirements:

• Prerequisites: Architectural model.
• Benefit: Detecting architectural violations of the security standard.

A structured manual analysis of an application specific business case or usage scenario. This analysis is guided by a set of precompiled security threats:

• Prerequisites: Business case or usage scenario.
• Benefits: Identification of threats, including their impact and potential countermeasures specific to the development of the software product.

Code Review During Application and Development

In the development stages where an application is not yet sufficiently mature enough to be placed into a test environment, the following techniques are applicable:

STATIC ANALYSIS AND SECURITY TESTING (SAST)

Throughout development, analysis tools and procedures can be used to find possible vulnerabilities without actually executing the source code by detecting instances of unsecure coding practices such as incorrect use of design templates, outdated libraries, misconfigurations, or improper data type usage.

STATIC BINARY CODE ANALYSIS AND MANUAL BINARY REVIEW

Analysis of the compiled application (binary) for finding vulnerabilities without executing the application. In general, this is like the source code analysis but is not as precise and fixed recommendations typically cannot be provided.

Thankfully, we have progressed beyond manual inspection techniques, allowing far more efficiency, and closing the differences between source code review and testing.