1

For an application that is hosted by a legacy server version which cannot be patched, could a periodic security centric application code review prevent potential exploitable vulnerabilities to the application? Can an application security code review replace non patchable servers? Let's say codes related to sensitive data in an application. A code review cannot replace patching or address all exploits but it could mitigate some risks that is caused by poor coding practices. If a legacy server is non patchable, wouldn't a security centric code review address at least some exploits that stem from poor coding practices?

1

No

Security code review is a good idea, but it does not protect against unpatched software. For example, if your server uses Nginx, it could have been vulnerable in the past to CVE-2013-2028. It doesn't matter what application code is present, because the vulnerability is in the web server itself. The best way to fix this vulnerability is to patch the server. There may be other ways to mitigate the vulnerability, but patching is almost always the best solution.

  • 1
    Agreed. Patching cannot be replaced. Would a secure code review mitigate risk related to exploitable vulnerabilities f – user107327 Aug 30 '16 at 16:21
  • @user107327 No, if the vulnerabilities are not in the application code (and in this scenario, they likely aren't) it doesn't matter what you do to review the applications, and perhaps even if you get rid of them completely. – Xander Aug 30 '16 at 16:22
  • if a legacy server is non patchable, wouldn't a code review address exploits that stem from poor coding practices? Agreed it can't replace patching and address all exploits. – user107327 Aug 30 '16 at 16:27
  • 1
    @user107327 - A code review will catch exploits that stem from poor coding. It does this regardless of whether the server is patchable or not. – paj28 Aug 30 '16 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.