Security Code Review and Secure Coding
What is Security Code Review and Secure Coding? How important is it? Are Security Code Review and Secure Coding part of your Application Security program?
Security Code Review
Code Review is a process that a person (usually Application Security Engineers or another developers) reviews all or part of the code written by another developer. Security Code Review means a Code Review that attempts to find security related weaknesses in the code.
Secure Coding
Secure Coding is the practice of writing applications in a way that protects itself against known vulnerabilities.
How to implement Security Code Review
It mostly depends on the company! Manually code review is time consuming so if you have enough time and resources to do it, you can do it for every code commit! But usually companies don’t have enough resources, So you should select most important parts of the application, (for example Authentication, Payment, Ordering and other important parts) and do code review for those parts.
References
https://www.michaelagreiler.com/code-reviews-at-google/
What can we do for Secure Coding?
You should train the developers! Developers should know most important vulnerabilities. And beside that they should know how they can develop their code to be free of vulnerabilities.
References
https://developer.android.com/topic/security/best-practices
As an Application Security Engineer how can I improve my Code Review/Secure Coding skills?
- Know the most important vulnerabilities related to the application.(web, mobile and …)
- Know the basics of Code Review/Secure Coding — Check the mentioned links and the following course
- Know the most important application architectures.
- Know the programming language,library,framework and all technologies related to the application. Use Youtube and other websites to learn a new language, framework and technologies.(we can’t master all available languages and frameworks! So you just need to know the basics to read the code)
Search for “X full course”, for example “Python full course” , “Spring full course”
- Practice secure coding on your language or framework.
Use mentioned platforms like Secure Code Warrior, Hackedu and Secure Flag.To try Secure Code Warrior platform you can follow them and register for upcoming tournaments. When you register for a tournament you can have access to their platform.(great platform) Also for Secure Flag platform you can buy OWASP membership and get access to the platform:
Summary
- Know vulnerabilities
- Know the basics of Secure Coding
- Know software architecture
- Know the programming language and framework
- Know secure coding of that language and framework
Original article: https://www.linkedin.com/pulse/security-code-review-secure-coding-mehdi-esmaeilpour/
