Source code security review

What a source code security review is

With a source code security review we identify vulnerabilities and security weaknesses directly in the program code, before an attacker can exploit them. The review gives deeper insight into the security of an application than classic penetration testing, because we also analyse those parts of the program logic and its implementation that are not directly visible from the outside.

In our work we combine automated static analysis (SAST) using the Fortify by OpenText platform, our own tools and manual analysis of the source code. Automated tools make it possible to review large volumes of code systematically, while our specialists verify the results, remove false positives and carry out an in-depth analysis of the security-critical parts of the application.

What we look for

We adapt the review to the technology used, the architecture of the application and its purpose. We pay particular attention to:

• improper validation and handling of user input,
• flaws in authentication, authorisation and access control,
• weaknesses in the management of user sessions,
• unsafe use of databases, files and system functions,
• improper use of cryptographic mechanisms,
• passwords, API keys and other secrets stored in the source code,
• inadequate handling of sensitive data,
• unsafe deserialisation and other vulnerable programming patterns,
• security-relevant flaws in business logic,
• configuration weaknesses and settings that carry security risk,
• vulnerable or outdated third-party libraries and components.

We carry out the review in line with established security guidelines and recommendations such as OWASP, CWE and CERT Secure Coding, and adapt the scope and depth of the analysis to each individual project.

Automated and manual analysis

Automated SAST analysis is an important part of the review, but on its own it cannot grasp the full context of an application. We therefore review the results from the Fortify platform and from our own tools ourselves, and complement them with manual analysis.

In the manual review we focus above all on critical functionality, data flows, authentication and authorisation mechanisms, the use of cryptography and business logic. This allows us to uncover more complex security weaknesses that automated analysis either does not detect at all or cannot evaluate correctly without knowledge of the context.

What you receive after the review

On completion you receive a detailed technical report with confirmed findings, an assessment of their criticality, identification of the problematic parts of the code and clear recommendations for remediation.

We do not tell developers only where a vulnerability is. We also explain why it presents a security risk and how to remediate it properly. Once the fixes have been implemented we can carry out a re-test and confirm that the measures were effective.