Web Application Security, 2nd Edition

Chapter 25. Reviewing Code for Security

The code review stage must always occur after the architecture stage in a security-conscious organization—never before.

Some technology companies today uphold a “move fast and break things” mantra, but such a philosophy often is abused and used as a method of ignoring proper security processes. Even in a fast-moving company, it is imperative that application architecture is reviewed prior to shipping code. Although, from a security perspective, it would be ideal to review the entire feature architecture up front, that may not be feasible in uncertain conditions. At a minimum, the major and well-known features should be architected and reviewed. When new features come up, they should be both architected and reviewed for security prior to development as well.

The proper time to review code for security gaps is once the architecture behind the code commit has been properly reviewed. This means code reviews should be the second step in an organization that follows secure development best practices.

This has two benefits. The first and most obvious benefit is that of security, but having an additional reviewer who typically is viewing the code from outside the immediate development team has its own merits as well. This provides the developer with an unbiased pair of eyes that may catch otherwise unknown bugs and architecture flaws.

As such, the code security review phase is vital for both application functionality as well as application security. ...