Questions tagged [manual-review]
The manual-review tag has no usage guidance.
12 questions
-1
votes
1
answer
659
views
What is the difference between "secure code review" and "secure static code analysis"?
What are the subtle differences in both - as one could say that both are almost the same...
Static Code Analysis (also known as Source Code Analysis) is usually
performed as part of a Code ...
- 11
0
votes
1
answer
407
views
How to Perform a Security Review of Apps from Mac App Store
As part of our software procurement process, we're evaluating the security of applications, e.g. by checking if there are non-addressed vulnerability reports and if the vendor embedded secure ...
- 1
3
votes
3
answers
995
views
Basic security checklist for using an open-source library
I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
- 4,006
2
votes
1
answer
235
views
Security server log review [closed]
We have a Kiwi Syslog server for Centralized logging purposes.
Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations.
We already used the necessary ...
- 21
8
votes
3
answers
2k
views
SPAM Email Analysis
What are the steps you would follow in order to identify in an email is a SPAM/SCAM/Phishing attempt? The reason I am asking this question is that sometimes very well crafted junk emails manage to ...
- 1,998
0
votes
1
answer
202
views
Applications security review [closed]
When a company wants to buy a new application, the security aspects must be reviewed (access rights, privileges, logs, data integrity ... etc).
Is there a standard for applications security reviews? ...
- 298
5
votes
2
answers
2k
views
What are good free opensource tools for helping in manual source code reviews? [closed]
I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
- 2,789
10
votes
5
answers
2k
views
Code Review Strategies
As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
- 1,141
6
votes
3
answers
1k
views
How to use and create attack graphs
I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
- 1,089
8
votes
4
answers
2k
views
Scripting a search through php files for dangerous calls for manual review
I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.
Does anyone have any recommendations for ...
- 16.2k
5
votes
1
answer
466
views
What security implications should I consider in relation to mcollective?
The use of PuppetLab's mcollective is being planned by my company's SysOps team. I will be reviewing their use of the tool and implementation of the system.
At this point I don't have a lot of ...
- 15.3k
19
votes
6
answers
6k
views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
AviD♦
- 73.6k