Code Reviews Benefit From Sample Test Setup
Reviewing codes is a large part of penetration testing. This article explains that the most efficient way to present a code to a tester for review is to implement a sample setup, which allows them to "preview" the codes function.
In theory, a code reviewer just needs the source code and design documents to do a code review. He wouldn’t need a sample test environment - that’s more for the pen testers, right?
It turns out that in practice, a sample setup is very useful to the code reviewer, too. Below are some reasons why.
The first step in a good code review is preparing the threat profile of the application. The threat profile identifies the threats relevant to the application, so the code reviewer can focus on those threats. To prepare the threat profile, he needs to undestand the features and functions of the application, as well as the best way to do, which is to walk through the application. A sample setup provides that opportunity on day one.
After the threat profile is created, the reviewer studies the code layout and creates the code review plan. The plan maps each threat in the code review to the relevant classes and pages. Notice that? To map the threats to the relevant pages, it helps to "see" the deployed application. Sure, it can be done by just looking at the raw code without seeing the app, but it’s a lot easier to map the pages after seeing them.
At times, the code is complex enough that the reviewer might have to invest a lot of time to unravel it. Often the simplest way out is to see the end result of the code - watch the pages or forms in action, and things start making sense faster. A code reviewer should be investing his time to discover holes. Trying to decipher convoluted code is a waste of time and reduces the time available for finding holes. Ergo, it is preferable to have a sample setup handy.
A sample setup also allows the code reviewer to verify the vulnerabilities he encounters in the code. He can test out an idea and confirm exploitation with the sample setup. This saves time later for the developers - they can focus their energies on fixing confirmed holes.
In our code reviews, we strongly encourage our clients to let use "see the app", and not just "see the code". The quality and speed of the code review improves, while the developer’s time to secure the application drops.
For more information about penetration testing, application security, or to contact a network security analyst, please visit plynt.com.
It turns out that in practice, a sample setup is very useful to the code reviewer, too. Below are some reasons why.
The first step in a good code review is preparing the threat profile of the application. The threat profile identifies the threats relevant to the application, so the code reviewer can focus on those threats. To prepare the threat profile, he needs to undestand the features and functions of the application, as well as the best way to do, which is to walk through the application. A sample setup provides that opportunity on day one.
After the threat profile is created, the reviewer studies the code layout and creates the code review plan. The plan maps each threat in the code review to the relevant classes and pages. Notice that? To map the threats to the relevant pages, it helps to "see" the deployed application. Sure, it can be done by just looking at the raw code without seeing the app, but it’s a lot easier to map the pages after seeing them.
At times, the code is complex enough that the reviewer might have to invest a lot of time to unravel it. Often the simplest way out is to see the end result of the code - watch the pages or forms in action, and things start making sense faster. A code reviewer should be investing his time to discover holes. Trying to decipher convoluted code is a waste of time and reduces the time available for finding holes. Ergo, it is preferable to have a sample setup handy.
A sample setup also allows the code reviewer to verify the vulnerabilities he encounters in the code. He can test out an idea and confirm exploitation with the sample setup. This saves time later for the developers - they can focus their energies on fixing confirmed holes.
In our code reviews, we strongly encourage our clients to let use "see the app", and not just "see the code". The quality and speed of the code review improves, while the developer’s time to secure the application drops.
For more information about penetration testing, application security, or to contact a network security analyst, please visit plynt.com.
Use the feedback form below to submit your comments.
Use the form below to email this article to your friends.
- Get the Best Results From Your Code Review
- Emails And Network Security
- Network Security - Why Securing Networks is Important ?
- Network Security
- Security Professionals Found Operating Unsecured Networks
- Remote Desktop Configuration Tips
- Keeping Your Network Safe
- Defense Pro by Radware - the Best Computer Defense Available
- Computer Consulting Services: Selling the Network as Security and Data Protection
- The Standard Penetration Test