1

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help explain if it would make sense to perform secure coding before QA and UAT testing. Questions below:

  1. Wouldn't it waste resources to perform secure code after testing? If remediations are required post secure code review, then the code will require to be QA and UAT tested again to ensure business requirements are met.

  2. Can real-time code secure code review in Visual Studio and Team Foundation Server (TFS) address secure code review requirement or does the codes require to be compiled again and scanned to ensure all vulnerabilities are addressed?

Thanks!

1

Automated secure code review can be done at anytime, it just might fail on incomplete or broken code.

I like my code reviews like I like my vulnerability scans from Qualys. As often as possible without disrupting the business (everyday high risk assets, entire business on weekends). Every commit should drive an automated review IMO, and a failure should be an immediate feedback to the developer.

A code review doesn't require compilation of said code. In fact, from a security perspective code can pass a security review even if it can't compile.

It's better to find a problem earlier in the dev cycle and fix it, rather than build on it.

  • Can real time secure code review features in development software such as Visual Studio or Team Foundation Server replace third party tools such as Veracode and Microfocus Fortify? Visual Studio allows extensions to include Veracode. This is why I ask is the secure coding features in development software is sufficiently address vulnerabilities. – user202927 Mar 27 at 3:40
  • Your requirement is for a secure code review. It doesn't state a veracode review. Selection of product is your choice. – opsecwin Mar 27 at 3:53
0
  1. Yes, it would waste resources to perform a secure code review after testing. This is why, as you pointed out OWASP Recommends that secure code reviews are conducted throughout the SDLC. Not at the end. The earlier you can pick up on a defect the less it costs to fix it.
  2. It depends on the method of code review. If for instance your team is doing manual code review then the code would not need to be recompiled. If however they where using a tool like Microfocus Fortify then, it requires the code get compiled during the scan to pick up 'taints' (user entered data that hasn't been sanitized).
  • Can real time secure code review features in development software such as Visual Studio or Team Foundation Server replace third party tools such as Veracode and Microfocus Fortify? Visual Studio allows extensions to include Veracode. This is why I ask is the secure coding features in development software is sufficiently address vulnerabilities. – user202927 Mar 27 at 3:40
  • No, it can't. They are much more like 'linters' that search for key words, rather than do the detailed analysis a product like vericode would do. Yes they have plugins, this is so it can scan while it compiles, like I already stated. – meowcat Mar 27 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.