All Questions
Tagged with code-review secure-coding
5 questions
0
votes
0
answers
137
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
- 101
0
votes
1
answer
461
views
Hiring an AppSec Engineer - What to look for?
I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
- 11
1
vote
2
answers
339
views
How to explain to our developer manager the benefits of using a linter also as a security feature?
Someone mentioned that linters would have helped not only for keeping the code looking better and friendlier, but also safer.
ESlint has a rule to indicate, for example, to use {} which would have ...
- 1,294
1
vote
1
answer
3k
views
Penetration Testing vs Secure Source Code Review [duplicate]
Recently I came across to a situation where an institution has hired a third party vendor to develop its business applications. I came up with the following questions related to penetration testing ...
- 455
2
votes
1
answer
2k
views
Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?
I am auditing (reverse engineering) an x86 C++ application without source code.
Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
- 21