Code Review

Code review is probably the single-most effective technique for identifying security flaws. When used together with penetration testing, code review can significantly increase the cost effectiveness of an application security verification effort.

Manual security code review provides insight into the “real risk” associated with insecure code. This is the single most important value from a manual approach. A human reviewer can understand the context for certain coding practices, and make a serious risk estimate that accounts for both the likelihood of attack and the business impact of a breach.

What is Secure Code Review?

Security code review is the process of auditing the source code for an application to verify that the proper security controls are present, that they work as intended, and that they have been invoked in all the right places. Code review is a way of ensuring that the application has been developed so as to be “self-defending” in its given environment. Security code review is a method of assuring secure application developers are following secure development techniques.

All security code reviews are a combination of human effort and technology support. At one end of the spectrum is an inexperienced person with a text editor. At the other end of the scale is a security expert with an advanced static analysis tool. Unfortunately, it takes a fairly serious level of expertise to use the current application security tools effectively.

At Arisen, we have a team of specialized application programs who help us in Code review process. Our Specialized code reviewers will check following Source Code Flaw:

• Input Validation
• Source Code Design
• Information Leakage and Improper error Handling
• Direct Object Reference
• Resource Usage
• API Usage
• Best Practices Violation
• Weak Session Management
• Using HTTP Get Query Strings