Source Code Review

Overview

Source Code Review plays a vital role in the Secure Software Development Lifecycle (SSDLC). Without adopting application security into your SSDLC you potentially run the risk of releasing vulnerability code into the wild for malicious actors to exploit. Vulnerable unchecked code could result in a major code and architectural overhaul to remediate. The benefits of performing regular code reviews prior to the release phase is to identify these issues and remediate them beforehand.

Our secure code review looks at the vectors that an attacker might leverage to conduct an exploit against your application. An undiscovered vulnerability may be present and could lead to an attacker injecting their own code or gaining unauthorised access to harvest and steal sensitive data. This may impact your business from legal fines imposed by GDPR penalties or loss of revenue through brand damage.

At CommSec we realise that not all companies have application security champions in house, a software engineer is not necessarily an application security expert. At CommSec we provide the following services to help companies bridge the gap.

Static Application Security Testing (SAST)

SAST involves the use of source code analysis tools that review the entire code base for vulnerabilities. Gartner’s definition of SAST is “a set of technologies designed to analyse application source code, byte code and binaries for coding and design conditions that are indicative of security vulnerabilities.” At CommSec our application security specialists will perform this task for you along with manually validating the results and providing you with a false positive free report. Our application security professionals will also provide you with remediation steps and are available to assist engineers with remediation advice.

Manual Code Secure Review

Manual code review differs from SAST and focuses on unwinding the business logic and understanding the intentions of the developer. Our application security engineer will focus on Authentication, Broken access controls, data access, error handling, input validation, output encoding to name a few.

Hybrid Testing

Is a more in-depth offering combining penetration testing with manual and static code review. At CommSec we offer the completely white box testing approach for companies who need their applications to be as secure as possible. Our security experts will perform a complete code review and verify the finding via penetration testing methodologies. This provides our clients with the vulnerabilities along with remediation and the location of the vulnerable code.

As part of a secure code review our application security specialists check for the following:

• Broken Authentication / Broken Access Control
• Database Communication Security
• Data Encryption
• Data Protection
• Error Handling
• File Management
• Hardcoded Credentials
• Input Validation
• Language-Specific Issues
• Memory Management
• Output Sanitization
• Security Through Obscurity
• Transport Layer Security

WHAT HAPPENS NEXT?

A member of our team will get back to you as soon as possible. They will find a suitable time to speak with you, answer any questions you have and help find the perfect solution to suit your requirements.