I am not familiar with all the steps involved in a full-fledged information security review of an in-house developed application, so I am wondering whether or not the following scenario is commonplace.
A web application is created, and runs on top of Microsoft's .NET framework.
Under the terms of the security review, all third party code, defined here (however rightly or wrongly) as code not written in-house, needs to be reviewed.
Thus, even the .NET stack itself - not just the in-house code written on top of the .NET stack - needs to be audited. So besides the initial audit of the code, any Microsoft updates would have to be audited. For instance, suppose the app is using MVC 5.2, and Microsoft releases MVC 5.3, and the app upgrades to MVC 5.3; in this case, the app could not pass review until (among other tests) the MVC 5.3 codebase itself is run through auditing/review.
Is this part of normal information security reviews?
Is it standard practice to conduct a security review of Microsoft's own code base when you build an app on the Microsoft stack?
How could one assume an internal auditing and review process (using whatever third party tools) would be more sophisticated than the tests Microsoft itself would run?
And where does this cycle stop? Who is to say the third party tools and/or internal tests are up to par? I guess there should be an audit of those processes as well. And then an audit of those audits...etc., etc., etc. At some point, this has to stop and there has to be a level of trust, right?