Finding security consultant for doing in-depth code review?

Question

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we have severe security flaws in our code even at the "logic level".

How/Where do I locate a consulting team that would do a manual code review to actually understand what WE were trying to do and then see where we went wrong / how the process could be circumvented? We tried a consultant which did what appeared to be just an automated scan of the code, and that added absolutely no value.

This question is based off of Getting a manual security code review done - What to watch out for? - I'm the same person, but I cant access my earlier cookie based session anymore.

Answer 1

Code review can be an expensive use of a consultants time and therefore your budget, to ensure you are getting value for money you could look to do the following;

1. Triage the code you require to be reviewed. This way you may find that you can focus on code that completes specific roles such as authorisation / session management / specific business logic etc. that you are worried about. If you then have budget left over you can move on to other less critical code areas.

2. Estimate the time and effort required As a very rough estimate you can use the 1k lines of code = one full day of review (not including reporting). Different languages and code complexity will change this, but it provides a good starting point when looking at budget requirements.

3. Automation as an aid Automated code scanning has its place, but only adds value if the consultant knows how to configure the tool and use it as an aid in their manual review. Using a blended automated-manual approach can speed the engagement up and lead to a reduced cost. The consultant should be skilled enough in the language being reviewed to understand the security issues and to remove any false-positives as well as insure no false-negatives get through.

4. Threat Model the application If you can understand the business logic and how attackers can interact with your application to a level that enables you to model potential attack vectors, then this will help define a more specific and focused code review. This level of detail can then be passed on to the consultant to ensure that they are aware of how the application works and this will enable them to provide tailored advice and guidance rather than a generic - here are some risks.

5. Place the findings in to context of the application At the end of the day you will need to make a call on which issues to fix and in what order of priority. Challenge the consultant to make clear recommendations and to provide evidence to help understand if findings from the code review are actually a threat - i.e. the code found to be vulnerable is at the back-end and their is no route for user interaction then this is a lower risk than if the vulnerable code is in the main authorisation code presented to the end user. This should reduce time internally and therefore become a cost saving that can be offset against the cost of the code review.

Answer 2

It depends in which country you're located. But there are a few things you should watch out for.

First, clearly define and document what you want to now. Do you want an in-depth security review, do you want an (in-dept?) quality review? Do you want advice/recommendations from the consultant regarding the development process? Do you want advice regarding choosing a development company? Make sure you make ALL you expectation explicit and document them in detail.

Besides, make sure to choose a competent firm. Request for references and spend some time to find a good one. Be prepared to spend some money on it, manual code review is VERY time consuming. Dont go for the very cheap ones, since they cannot provide you a real solution simply because time = money and you need the time to perform an in-depth manual review.

In this case you need a very technical consultancy firm, don't take a management consultancy firm which also provide technical services.

Answer 3

You need to consider both the breadth and depth of the review. By breadth, I mean what range of risks/attacks/threats will be covered in the review. You should start with the OWASP Application Security Verification Standard to get an idea of what ought to be covered here. By depth, I mean how well will the consultant verify that each area has been adequately defended. At the low end, an automated tool scan provides little assurance. At the high end, a manual inspection or actual test case should essentially prove that the correct defenses are in place, have been designed correctly, and are used everywhere that they need to be.

Don't fall for the argument that code review is necessarily more time consuming than other approaches. In many cases it is hands-down the most efficient way to verify security quickly, accurately, and with the best coverage possible.

Check with some of the companies involved with OWASP. They've got extensive experience verifying the security of web applications cost-effectively.