For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the application? Can an application security code review replace non patchable servers? Let's say codes related to sensitive data in an application. A code review cannot replace patching or address all exploits but it could mitigate some risks that is caused by poor coding practices. If a legacy server is non patchable, wouldn't a security centric code review address at least some exploits that stem from poor coding practices?
1
-
What code would you be reviewing?– Alexander O'MaraCommented Aug 30, 2016 at 15:47
Add a comment
|
1 Answer
No
Security code review is a good idea, but it does not protect against unpatched software. For example, if your server uses Nginx, it could have been vulnerable in the past to CVE-2013-2028. It doesn't matter what application code is present, because the vulnerability is in the web server itself. The best way to fix this vulnerability is to patch the server. There may be other ways to mitigate the vulnerability, but patching is almost always the best solution.
-
1Agreed. Patching cannot be replaced. Would a secure code review mitigate risk related to exploitable vulnerabilities f Commented Aug 30, 2016 at 16:21
-
@user107327 No, if the vulnerabilities are not in the application code (and in this scenario, they likely aren't) it doesn't matter what you do to review the applications, and perhaps even if you get rid of them completely.– XanderCommented Aug 30, 2016 at 16:22
-
if a legacy server is non patchable, wouldn't a code review address exploits that stem from poor coding practices? Agreed it can't replace patching and address all exploits. Commented Aug 30, 2016 at 16:27
-
1@user107327 - A code review will catch exploits that stem from poor coding. It does this regardless of whether the server is patchable or not.– paj28Commented Aug 30, 2016 at 16:28