- Is this a common practice where full, unrestricted access to proprietary software source code is given to a 3rd party for the sake of security testing?
I would say yes, but with a couple of footnotes.
It's common these days to expect a vendor to do SAST and DAST scanning of their products. In my experience, most 3rd party partners are happy to accept attestation that SAST and DAST testing is part of your routine software development lifecycle (SDLC), you address any Critical and High as part of each release. etc. This duty is typically performed either by developers or by an internal appsec team. If you don't have that as part of your internal SDLC process, then your only other option is to hire an outside company to do it as a one-off security assessment.
So IMHO intellectual property concerns is not a valid a reason for not doing security testing on your products; you have the option of buying the tools and doing the scans internally.
- It seems the opposite of secure when it comes to protecting your intellectual property. What precautions, if any, should be taken when entering a source code review with a 3rd party?
Any professional security testing company will be used to working with their customers' intellectual property -- and heaven forbid they find a real vulnerability in your product or accidentally get their hands on data they shouldn't have during the course of their security testing. That's all normal for a security testing company.
Make sure you have a good Non-Disclosure Agreement (NDA) in place with them -- the sec company probably has an NDA template, have it reviewed by your own legal team.
Make sure the security testing contract lays out the scope of the security test (what they are and are not allowed to test, for example list IP addresses and ports that are in-scope and that the rest of your network is out of scope). You could also put in contract language about how to handle vulnerabilities or data that they discover.