Automated Code Review - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T16:56:21Z

Added navigation to facilitate sequential reading online

KirstenS: /* Education and cultural change */

2009-01-15T21:47:28Z

‎Education and cultural change

KirstenS: /* '''Tool Deployment model:''' */

2009-01-15T21:47:08Z

‎'''Tool Deployment model:'''

KirstenS: /* '''Education and cultural change:''' */

2009-01-15T21:46:55Z

‎'''Education and cultural change:'''

KirstenS: Automating Code Reviews moved to Automated Code Review

2009-01-15T21:45:44Z

Automating Code Reviews moved to Automated Code Review

KirstenS: /* Reasons for using automated tools */

2009-01-15T21:41:11Z

‎Reasons for using automated tools

KirstenS: /* '''Reasons for using automated tools:''' */

2009-01-15T21:40:48Z

‎'''Reasons for using automated tools:'''

KirstenS: /* Preface */

2009-01-15T21:40:16Z

‎Preface

Rahimjina: Review

2008-08-26T21:58:02Z

Review

Namn: typo

2008-06-24T08:04:16Z

typo

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 ==Preface==
@@ Line 17: / Line 22: @@
 [[Category:OWASP Code Review Project]]

@@ Line 11: / Line 11: @@
 In large scale code review operations for enterprises such that the volume of code is enormous, automated code review techniques can assist in improving the throughput of the code review process.
-==Education and cultural change==
+==Education and Cultural Change==
 Educating developers to write secure code is the paramount goal of a secure code review. Taking code review from this standpoint is the only way to promote and improve code quality. Part of the education process is to empower developers with the knowledge in order to write better code.

← Older revision		Revision as of 21:47, 15 January 2009
Line 16:		Line 16:
	This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality, and also help reduce the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand. Also, running a tool to assess the code is a fairly painless task once the developer becomes familiar with the tool(s).		This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality, and also help reduce the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand. Also, running a tool to assess the code is a fairly painless task once the developer becomes familiar with the tool(s).

−	~~== '''Tool Deployment model:''' ==~~

−	Deploying code review tools to developers helps the throughput of a code review team by helping to identify and hopefully remove most of the common and simple coding mistakes prior to a security consultant viewing the code.
−
−	~~This methodology improves developer knowledge and also the security consultant can spend time looking for more abstract vulnerabilities.~~

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]

@@ Line 11: / Line 11: @@
 In large scale code review operations for enterprises such that the volume of code is enormous, automated code review techniques can assist in improving the throughput of the code review process.
-== '''Education and cultural change:''' ==
+==Education and cultural change==
 Educating developers to write secure code is the paramount goal of a secure code review. Taking code review from this standpoint is the only way to promote and improve code quality. Part of the education process is to empower developers with the knowledge in order to write better code.
-This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality and also help reducing the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand.
+This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality, and also help reduce the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand. Also, running a tool to assess the code is a fairly painless task once the developer becomes familiar with the tool(s).
 == '''Tool Deployment model:''' ==

@@ Line 8: / Line 8: @@
 However, these tools don't eliminate the need for a human reviewer, as they produce both false positive and false negative results.
-==Reasons for using automated tools==
+==Reasons for Using Code Review Tools==
 In large scale code review operations for enterprises such that the volume of code is enormous, automated code review techniques can assist in improving the throughput of the code review process.

← Older revision	Revision as of 21:45, 15 January 2009
(No difference)

@@ Line 2: / Line 2: @@
 ==Preface==
-While manual code reviews can find security flaws in code, they suffer from two problems.  Manual code reviews are slow, covering 100-200 lines per hour on average.  Also, there are hundreds of security flaws to look for in code, while humans can only keep about seven items in memory at once.  Source code analysis tools can search a program for hundreds of different security flaws at once at a rate far greater than any human can review code.  However, these tools don't eliminate the need for a human reviewer, as they produce both false positive and false negative results.
+Also, there are hundreds of security flaws to look for in code, while humans can only keep about seven items in memory at once. Source code analysis tools can search a program for hundreds of different security flaws at once, at a rate far greater than any human can review code.
 == '''Reasons for using automated tools:''' ==

@@ Line 13: / Line 13: @@
 == '''Education and cultural change:''' ==
-Educating developers to write secure code is the paramount goal of a secure code review. Taking code review from this standpoint is the only way to promote and improve code quality. Part of the education process is to empower devlopers with the knowledge in order to write better code.
+Educating developers to write secure code is the paramount goal of a secure code review. Taking code review from this standpoint is the only way to promote and improve code quality. Part of the education process is to empower developers with the knowledge in order to write better code.
 This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality and also help reducing the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand.
@@ Line 23: / Line 23: @@
 Deploying code review tools to developers helps the throughput of a code review team by helping to identify and hopefully remove most of the common and simple coding mistakes prior to a security consultant viewing the code.
-This methodology improves developer knowledge and also the security consultant can spend time looking for more abstract vulerabilities.
+This methodology improves developer knowledge and also the security consultant can spend time looking for more abstract vulnerabilities.
 [[Category:OWASP Code Review Project]]

← Older revision		Revision as of 08:04, 24 June 2008
Line 16:		Line 16:

	This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality and also help reducing the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand.		This can be done by providing developers with a controlled set of rules which the developer can compare their code to. Automated tools provide this functionality and also help reducing the overhead from a time perspective. A developer can check his/her code using a tool without much initial knowledge of the security concerns pertaining to their task at hand.
−	Also running a tool to assess the code if a fairly painless task once the developer becomes familiar ~~wth~~ the tool(s).	+	Also running a tool to assess the code is a fairly painless task once the developer becomes familiar with the tool(s).