Security Code Review: Best Practices and Process

Code review is a proven technique for identifying security flaws and improving software quality. This article outlines an effective security code review process along with best practices to maximize impact.

If you are considering Threat Modelling Training simply get in touch with our dedicated team and we will be happy to assist. 

Why Perform Security Code Reviews?

Manual code review complements automated scanning tools by discovering threats missed by automation. Humans excel at semantic understanding to spot subtle issues like authentication bypass flaws, insecure designs, race conditions and business logic errors.

Other key benefits of security code review include:

• Identifying vulnerabilities early before release where fixes are cheaper.
• Improving developers' security skills through shared learning during reviews.
• Raising security awareness when integrated into SDLCs.
• Increasing visibility into app risk levels for stakeholders.
• Ensuring due diligence for compliance with security regulations.

Regular code reviews are a crucial part of proactive AppSec programs.

Overview of the Security Code Review Process

A structured methodology ensures consistent, high quality code reviews. Key steps include:

1. Prepare review materials - Source code, libraries, specs, tools, checklists.

2. Assign reviewers and scope - Pick experienced reviewers, set review targets.

3. Perform initial review - Manual inspection of code logic and design.

4. Verify issues - Reproduce vulnerabilities, confirm legitimacy.

5. Prioritize issues - Rank severity based on impact and likelihood.

6. Track remediation - Log bugs, verify fixes in later sprints.

7. Report results - Communicate findings to stakeholders.

Mature programs use risk ratings and metrics to gauge code review efficacy over time.

Forming an Effective Review Team

Success begins with the reviewers. Look for these qualities:

• Secure coding expertise - Deep knowledge of vulnerabilities like injection, XSS, authn/authz.
• Programming proficiency in target languages - Understand code constructs and data flows.
• Technical curiosity - Dig into unfamiliar components.
• Attention to detail - Closely inspect code logic.
• Communication skills - Convey issues clearly to developers.

Include architects familiar with overall design and feature owners with business logic insights.

Rotate participants across reviews to spread knowledge.

Picking the Right Review Targets

Carefully prioritizing review targets maximizes impact:

• New or modified code - Where most bugs originate. Verify fixes work.
• High risk areas - Authentication, session management, privilege levels.
• Integrations - Third party libraries and dependencies.
• Critical flows - Account signup, transaction processing.
• Threat model insights - Focus on identified components.

Sampling broadens coverage once critical code is secured. Configure tools to scan everything.

Divide large codebases into manageable subsets for incremental reviews.

Performing Manual Inspections

Thorough manual inspection by appropriately skilled humans finds vulnerabilities tools miss. Some tips:

• Rigorously follow checklists aligned with top risks like OWASP Top 10.
• Closely analyze authentication and access controls. Key flaws happen here.
• Understand data flows. Trace input handling, processing, output.
• Watch for race conditions and logic flaws. Hard for tools.
• Verify parameterization. SQLi, command injection love input concatenation.
• Check encryption uses secure algorithms, keys, IVs.
• Analyze session management for spoofing, hijacking risks.
• Confirm output encoding and input validation prevent XSS.
• Inspect config for hardcoded secrets, insecure settings.

Take notes through issues for reporting and tracking.

Validating and Prioritizing Findings

Confirm reported issues through steps to reproduce. Weed out false positives.

Rank valid flaws by severity and risk levels:

• Critical - High likelihood, impact. Fix before release.
• High - Significant risk, but lower priority. Remediate soon.
• Medium - Moderate risk. Schedule fix.
• Low - Minimal risk. Fix opportunistically.

Align ratings with organizational risk tolerance. Provide technical justification for ratings.

Quantitative scores incorporating damage potential, mitigations and threat agent factors further assist ranking.

Driving Accountability for Fixing Issues

The review doesn't end when results get reported. Track issues through resolution:

• Log tickets for development teams. Link code review results.
• Verify ticket handling - QA testing, scheduling, closure.
• Analyze trends - Issue types, new vs regressions.
• Report progress at AppSec steering meetings.
• Notify management of delays or lack of suitable fixes.

Integrate with existing workflows like integrations with Jira and formal change approval processes.

Celebrate developers who consistently deliver solid, secure code. Call out chronic offenders.

Measuring Efficacy and ROI

Code review efficacy metrics quantify progress:

• Number of reviews per release - Consistency matters.
• Critical issues pre-release - Nip big risks early.
• Time and cost per review - Streamline over time.
• Issues by type - Show improvement areas.
• Time-to-resolution - Fix critical fast.
• Reviews with no issues - Increase clean results.

Present trend lines to demonstrate improving maturity over time.

Compare costs against projected losses from exploited bugs to justify investment.

Integrating Security Code Review into the SDLC

To deeply integrate security code review:

• Build into official process - Require for releases.
• Train developers - Grow AppSec awareness.
• Start reviews early - Fix flaws cheaply.
• Automate tools - Scan constantly, guide manual analysis.
• Utilize findings - Feed data to threat modeling.
• Report metrics - Demonstrate value to leadership.

Sustained AppSec commitment pays compounding dividends over time as developing secure software becomes integral to engineering culture.

Selecting SAST Tools to Complement Manual Review

SAST (Static Application Security Testing) automatically scans code for vulnerabilities. Well-chosen tools boost review efficiency:

• Scan highly stale code that's evolved significantly.
• Guide manual inspection toward higher risk areas.
• Provide alternate analysis to confirm results.
• Regression test fixes.
• Continuously scan as a safety net for human error.

Avoid over-reliance on automation. The best tools empower people who understand app semantics and risks.

Performing Incremental Focused Reviews

For large, complex codebases, conquer security inch-by-inch:

1. Establish a baseline - Initial broad scan for coverage.
2. Break into manageable chunks - Components, services, modules.
3. Rank and prioritize chunks - Business logic, user authn/z.
4. Schedule sequentially - Fix critical chunks before broader release.
5. Revisit periodically - Refresh high risk areas.
6. Report progress - Metrics show incremental hardening.

Celebrate milestones after addressing significant risk areas. Momentum builds as progress becomes visible.

Putting People First with "Shift Left"

Modern software teams fix flaws through fast feedback cycles. Enable this for security:

• Equip developers with secure coding skills via mentoring and training.
• Provide guidelines, libraries and tools baked into their workflow.
• Reward secure coding practices - Make AppSec proficiency visible.
• Automate testing and policy enforcement in the pipeline.
• Act on feedback - Fix flaws early through collaborative design reviews.
• Thank developers who consistently deliver solid code.

Humans empowered with knowledge, tools and feedback loops write better software.

Integrating Security into Design Reviews

Design decisions profoundly influence downstream security. Rigorously evaluate proposed designs for risks:

• Who can access what resources?
• How is privilege compartmentalized?
• What data requires encryption?
• Where must input validation occur?
• What threat scenarios should be assumed?

Probe assumptions and weigh alternatives:

• What third-party integrations are involved?
• Does this open attack vectors?
• What user experience tradeoffs result?

Nip fundamentally flawed designs in the bud. Question everything.

Scaling Code Review Through Automation

Manual code review scales poorly. Automation brings consistency:

• Scan constantly - Every commit.
• Enforce policies - Break the build on violations.
• Guide manual review - Focus high expertise on flagged areas.
• Confirm fixes - Ensure issues can't regress.
• Provide guardrails - Warn on common bad practices.

Automate where possible but still enable human judgement.

Automation without insight breeds cargo cult security.

Frequently Asked Questions

What is an appropriate size review chunk?

1,000 - 2,000 lines of code per hour is a sustainable pace. Break code into review sessions accordingly.

When should developers vs security experts perform reviews?

Developers find local issues. Experts identify subtle risks needing broader domain knowledge. Use both.

What balance of code review vs testing is appropriate?

Testing confirms code works as intended. Reviews surface risks testing could miss. Do both thoroughly.

If you enjoyed this article check out Threat Modelling: Steps, Techniques and Tips