Difference between revisions of "Security Code Review in the SDLC"

From OWASP
Jump to: navigation, search
(Preface)
Line 13: Line 13:
 
# Team review
 
# Team review
 
# Inspection
 
# Inspection
 +
 +
 +
== Mature Secure Code Review (SCR) Model ==
 +
 +
Throughout the SDLC there are points at which an application security consultant should get involved. These points, "touch points" can be used to investige the status of the code being developed from a security standpoint. The reason for interviening at regular intervals is that potential issues can be detected early on in the development life cycle and hence total cost of ownership (TCO) is less in the long term.
 +
 +
'''Waterfall SDLC exmaple'''
 +
#Requirements definition               
 +
## Functional specification
 +
#Design
 +
## Detailed design specification       
 +
#Development
 +
##Coding                               
 +
## Unit test                           
 +
#Test
 +
##functional Testing                     
 +
## System testing
 +
##integration testing                   
 +
##UAT (User acceptance testing
 +
#Deployment
 +
## Change control
 +
# Maintenance
 +
 +
 
[[Category:OWASP Code Review Project]]
 
[[Category:OWASP Code Review Project]]

Revision as of 09:01, 2 January 2007

OWASP Code Review Guide Table of Contents

Contents


Preface

Code reviews vary widely in their level of formality. Reviews can be as informal as inviting a friend to help look for a hard to find bug, and they can be as formal as a software inspection process with trained teams, assigned roles and responsibilities, and a formal metric and quality tracking program.

In Peer Reviews in Software, Karl Wiegers lists seven review processes from least to most formal:

  1. Ad hoc review
  2. Passaround
  3. Pair programming
  4. Walkthrough
  5. Team review
  6. Inspection


Mature Secure Code Review (SCR) Model

Throughout the SDLC there are points at which an application security consultant should get involved. These points, "touch points" can be used to investige the status of the code being developed from a security standpoint. The reason for interviening at regular intervals is that potential issues can be detected early on in the development life cycle and hence total cost of ownership (TCO) is less in the long term.

Waterfall SDLC exmaple

  1. Requirements definition
    1. Functional specification
  2. Design
    1. Detailed design specification
  3. Development
    1. Coding
    2. Unit test
  4. Test
    1. functional Testing
    2. System testing
    3. integration testing
    4. UAT (User acceptance testing
  5. Deployment
    1. Change control
  6. Maintenance