Code Review Guide History - Revision history

Thomas Herlea: Added navigation to facilitate sequential reading online

2010-09-09T14:26:29Z

Added navigation to facilitate sequential reading online

KirstenS at 12:54, 23 January 2009

2009-01-23T12:54:53Z

KirstenS: Long long ago... moved to Code Review Guide History

2009-01-08T16:25:36Z

Long long ago... moved to Code Review Guide History

KirstenS at 16:25, 8 January 2009

2009-01-08T16:25:11Z

KirstenS at 15:35, 5 January 2009

2009-01-05T15:35:09Z

Rahimjina at 11:24, 3 August 2008

2008-08-03T11:24:53Z

EoinKeary at 11:27, 24 October 2007

2007-10-24T11:27:14Z

EoinKeary at 10:49, 3 August 2007

2007-08-03T10:49:00Z

EoinKeary at 11:32, 19 January 2007

2007-01-19T11:32:01Z

New page

[[OWASP Code Review Guide Table of Contents]]__TOC__

The Code Review guide is the result of contributing to the Testing Guide.
Initially it was thought to place Code review and Testing into the same guide. But code review got too big and evolved into itso own stand alone guide.

The code review guide was started by [User:Eoin Keary] and is currently in its infancy. Eoin was lead of an application security group for a large financial institution and was involved with the code review process for many years. It was found that a proper code review function that is integrated into the software development process /Lifecycle (SDLC) produced remarkably better code from a security standpoint.

"Secure code review is the sign of a mature SDLC and in my view much more sustainable and controllable than the pen and patch model"

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
 The Code Review guide is the result of initially contributing and leading the Testing Guide. Initially, it was thought to place Code review and testing into the same guide; it seemed like a good idea at the time. But the topic called security code review got too big and evolved into its own stand-alone guide.
@@ Line 8: / Line 12: @@
 By necessity, this guide does not cover all languages; it mainly focuses on .NET and Java, but has a little C/C++ and PHP thrown in also. However, the techniques advocated in the book can be easily adapted to almost any code environment. Fortunately, the security flaws in web applications are remarkably consistent across programming languages.

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
-The Code Review guide is the result of initially contributing and leading the Testing Guide. Initially it was thought to place Code review and testing into the same guide; it seemed like a good idea at the time. But the topic called security code review got too big and evolved into its own stand-alone guide.
+The Code Review guide is the result of initially contributing and leading the Testing Guide. Initially, it was thought to place Code review and testing into the same guide; it seemed like a good idea at the time. But the topic called security code review got too big and evolved into its own stand-alone guide.
 The Code Review guide was started in 2006. The Code Review team consists of a small, but talented, group of volunteers who should really get out more often.
-The team noticed that organizations with a proper code review function integrated into the software development lifecycle (SDLC) produced remarkably better code from a security standpoint. This observation has borne out in practice, as many security vulnerabilities are easier to find in the code than by using other techniques.
+The team noticed that organizations with a proper code review functions integrated into the software development lifecycle (SDLC) produced remarkably better code from a security standpoint. This observation has borne out in practice, as many security vulnerabilities are easier to find in the code than by using other techniques.
 By necessity, this guide does not cover all languages; it mainly focuses on .NET and Java, but has a little C/C++ and PHP thrown in also. However, the techniques advocated in the book can be easily adapted to almost any code environment. Fortunately, the security flaws in web applications are remarkably consistent across programming languages.

@@ Line 1: / Line 1: @@
 [[OWASP Code Review Guide Table of Contents]]__TOC__
-The Code Review guide is the result of initially contributing and leading the Testing Guide.
+The Code Review guide is the result of initially contributing and leading the Testing Guide. Initially it was thought to place Code review and testing into the same guide; it seemed like a good idea at the time. But the topic called security code review got too big and evolved into its own stand-alone guide.
-The Code Review guide was started in 2006. The Code Review team consists of a small, but talented, group of volunteers who should really get out more often.
+The team noticed that organizations with a proper code review function integrated into the software development lifecycle (SDLC) produced remarkably better code from a security standpoint. This observation has borne out in practice, as many security vulnerabilities are easier to find in the code than by using other techniques.
-It was found that a proper code review function which is integrated into the software development process /Lifecycle (SDLC) produced remarkably better code from a security standpoint. It is also cheaper and looking at the "Security @ source" industry it seems that the trend in application security is heading in this direction.
+By necessity, this guide does not cover all languages; it mainly focuses on .NET and Java, but has a little C/C++ and PHP thrown in also. However, the techniques advocated in the book can be easily adapted to almost any code environment. Fortunately, the security flaws in web applications are remarkably consistent across programming languages.

@@ Line 2: / Line 2: @@
 The Code Review guide is the result of initially contributing and leading the Testing Guide.
-Initially it was thought to place Code review and testing into the same guide, seemed like a good idea at the time. But the topic called secure code review got too big and evolved into its own stand alone guide.
+Initially it was thought to place Code review and testing into the same guide; it seemed like a good idea at the time. But the topic called secure code review got too big and evolved into its own stand-alone guide.
-The code review guide was started in 2006. The code review team consists of a small but talented group of volunteers who should really get out more often.
+The Code Review guide was started in 2006. The Code Review team consists of a small, but talented, group of volunteers who should really get out more often.
 It was found that a proper code review function which is integrated into the software development process /Lifecycle (SDLC) produced remarkably better code from a security standpoint. It is also cheaper and looking at the "Security @ source" industry it seems that the trend in application security is heading in this direction.
@@ Line 11: / Line 11: @@
 "Secure code review is the sign of a mature SDLC and in our view much more sustainable and controllable than the pen and patch model"
-The guide does not cover all languages; it mainly focuses on .NET and Java but has a little C/C++ and PHP thrown in also.
+The guide does not cover all languages; it mainly focuses on .NET and Java, but has a little C/C++ and PHP thrown in also.
 To write a guide that covers all languages would take too long and be too big.

@@ Line 18: / Line 18: @@
 Good Luck,
-Slan,
+Slán,
 Eoin

← Older revision	Revision as of 16:25, 8 January 2009
(No difference)

← Older revision		Revision as of 11:27, 24 October 2007
Line 5:		Line 5:


−	The code review guide was started ~~by [[User:EoinKeary\|Eoin Keary]]~~. The code review team consists of a small but talented group of volunteers who should really get out more often.	+	The code review guide was started in 2006. The code review team consists of a small but talented group of volunteers who should really get out more often.

	It was found that a proper code review function which is integrated into the software development process /Lifecycle (SDLC) produced remarkably better code from a security standpoint. It is also cheaper and looking at the "Security @ source" industry it seems that the trend in application security is heading in this direction.		It was found that a proper code review function which is integrated into the software development process /Lifecycle (SDLC) produced remarkably better code from a security standpoint. It is also cheaper and looking at the "Security @ source" industry it seems that the trend in application security is heading in this direction.