Questions tagged [manual-review]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
358 views

What is the difference between "secure code review" and "secure static code analysis"?

What are the subtle differences in both - as one could say that both are almost the same... Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code ...
user avatar
0 votes
1 answer
282 views

How to Perform a Security Review of Apps from Mac App Store

As part of our software procurement process, we're evaluating the security of applications, e.g. by checking if there are non-addressed vulnerability reports and if the vendor embedded secure ...
user avatar
  • 1
3 votes
3 answers
780 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
user avatar
  • 3,876
1 vote
1 answer
212 views

Security server log review [closed]

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
user avatar
  • 11
8 votes
3 answers
2k views

SPAM Email Analysis

What are the steps you would follow in order to identify in an email is a SPAM/SCAM/Phishing attempt? The reason I am asking this question is that sometimes very well crafted junk emails manage to ...
user avatar
  • 1,958
0 votes
1 answer
174 views

Applications security review [closed]

When a company wants to buy a new application, the security aspects must be reviewed (access rights, privileges, logs, data integrity ... etc). Is there a standard for applications security reviews? ...
user avatar
5 votes
2 answers
2k views

What are good free opensource tools for helping in manual source code reviews? [closed]

I know tools that help in identifying security vulnerabilities in source code (static analysis tools), like Findbugs for Java or Pixy for PHP, but I would like to know good free opensource tools that ...
user avatar
  • 2,749
10 votes
5 answers
2k views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
user avatar
  • 1,121
6 votes
3 answers
1k views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
user avatar
  • 979
8 votes
4 answers
2k views

Scripting a search through php files for dangerous calls for manual review

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed. Does anyone have any recommendations for ...
user avatar
  • 16.1k
5 votes
1 answer
443 views

What security implications should I consider in relation to mcollective?

The use of PuppetLab's mcollective is being planned by my company's SysOps team. I will be reviewing their use of the tool and implementation of the system. At this point I don't have a lot of ...
user avatar
  • 15.1k
18 votes
6 answers
6k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
user avatar
  • 72k