Source code reviews and source code security reviews are not quite the same. In this video, learn some of the challenges you're likely to face when performing source code security reviews.
- [Instructor] While documenting all of your … application security controls provides a solid foundation … for your offline testing efforts, … performing source code security reviews … is going to make up most of your testing activity … once that documentation is in place. … The first thing a tester needs to understand … is that code reviews and code security reviews … are not the same thing. … A source code review focuses on functionality. … Does the application work? … Does it do what it was designed to do? … A code security review focuses on resilience. … Can an attacker break the application? … Can the attacker make the app do something … the developers didn't design it to do? … Consider the zip code field for a moment. … If your application asks the user to enter a home address, … then it's very likely there's a field for the zip code. … From the developer's point of view, … this is most likely a field that accepts user input, … say, five numbers, and then compares that entry … to a back end database that maps zip codes …
- Security frameworks
- OWASP Top Ten
- Building Security In Maturity Model (BSIMM)
- Planning your testing projects
- Creating security policies
- Source code reviews
- Application threat modeling
- Offline testing for OWASP Top Ten vulnerabilities
Skill Level Intermediate
DevSecOps: Automated Security Testingwith James Wickett1h 35m Intermediate
Security Testing Essential Trainingwith Jerod Brennen2h 48m Beginner
Security Testing: Nmap Security Scanningwith Mike Chapple1h 46m Intermediate
What you should know1m 17s
1. Leading Practices
2. Security Documentation
3. Source Code Security Reviews
4. Offline Testing for the OWASP Top Ten (2017)
Next steps3m 18s
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.