This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Security Code Review in the SDLC

Revision as of 14:25, 3 August 2008 by Rahimjina (talk | contribs) (Review - minor editing of typos / punctuation)

Jump to: navigation, search
OWASP Code Review Guide Table of Contents


Code reviews vary widely in their level of formality. Reviews can be as informal as inviting a friend to help look for a hard to find bug or they can be as formal as a software inspection process with trained teams, assigned roles and responsibilities, and a formal metric and quality tracking program.

In Peer Reviews in Software, Karl Wiegers lists seven review processes from least to most formal:

  1. Ad hoc review
  2. Passaround
  3. Pair programming
  4. Walkthrough
  5. Team review
  6. Inspection

Mature Secure Code Review (SCR) Model

Throughout the SDLC there are points at which an application security consultant should get involved. These "touch points" can be used to investige the status of the code being developed from a security standpoint. The reason for interviening at regular intervals is that potential issues can be detected early on in the development life cycle and hence the total cost of ownership (TCO) is less in the long term.

Waterfall SDLC exmaple

  • Requirements definition
    • Functional specification
  • Design
    • Detailed design specification
  • Development
    • Coding
  • Unit tests
  • Test
    • Functional testing
    • System testing
    • Integration testing
    • UAT (User acceptance testing)
  • Deployment
    • Change control
  • Maintenance

Minimal Resource Available Code Review for Web Applications Model

Very often, risk managers are tasked to manually code review large applications with minimal time and resources. This guide will focus on streamlining the manual code review process and outline the bare minimal essentials that are required for review.

Manual Code Review should at LEAST focus on:

  1. Authorization
  2. Access Control
  3. Input Validation
  4. Error Handling
  5. Session Management
  6. Form Keys or Frequent Session Rotation (for CSRF defense)
  7. Proper Application Logging