Secure Code Review

In its first iterations, code review involved lengthy, time-consuming formal reviews. As development speeds increased, this longer review evolved into a more dynamic and lightweight process that keeps pace with agile and modern development methodologies.

Today, there are review tools available that easily integrate into SCM/IDEs. Tools like static application security testing (SAST) provide inputs in addition to manual reviews, helping developers find and fix vulnerabilities. These tools are compatible with numerous development environments like GitHub and GitLab, or IDEs like Eclipse and IntelliJ, so developers can work in their preferred environment.

Code review—manual, automated, or a mixture of the two—can be initiated via an automated notification or by a human. Current best practices for performing robust and secure code review involve using manual and automated reviews together. This tandem approach catches the most potential issues.

Secure code review can occur at any time during the software development life cycle (SDLC), but it’s most impactful when performed earlier, because that’s when it’s easiest and fastest to make fixes to the code. In particular, using automated code review when developers are actually writing code allows for immediate changes as needed. Manual code review is very helpful when performed during the commit phase, or when a merge request is submitted to the repository. It also is a way to review code while taking into account business logic and developer intentions.

Automated review enables large codebases to be quickly and efficiently analyzed. Developers perform this review using either open source or commercial tools while they are coding, to help find vulnerabilities in real time. The most advanced development teams also include SAST tools, which can provide additional inputs, help find vulnerabilities, and enable developers to fix them before the code is checked in. The most successful development processes also involve developers performing their own self-reviews as they code.

Manual review involves a thorough review of the entire codebase by a senior or more experienced developer. This process can be extremely tedious and time-consuming, but it identifies flaws, such as business logic problems, that automated tools may miss. Layering in QA tests can help as well, but there are still scenarios that manual testing can miss. The best practice is a combination of automated and manual review.

Combining manual review with feedback from tools like SAST improves the overall security of the code being committed, and helps reduce the number of flaws that slip into production.

Secure code review is a critical process employed by the most successful development teams. It can:

• Reduce the number of delivery defects found at a later stage in the SDLC
• Decrease the amount of time developers spend fixing late-stage defects, thereby increasing productivity
• Reduce the number of bugs and security vulnerabilities going into production
• Improve consistency across codebases and increase maintainability
• Improve collaboration, knowledge sharing, and developer productivity, and lessons learned can help inform future code development
• Improve ROI by helping make processes faster and more secure, and use less resources and time

The key components involved in successful secure code review include:

• A combination of manual and automated review
• Collaboration, including sharing of knowledge and lessons learned
• A study of metrics, which helps reduce defects and policy violations before merging the code

Black Duck is a recognized leader in the application security industry. With its state-of-the-art Coverity® SAST solution, Black Duck can help developers improve their productivity during the code review process.

In today’s modern DevOps environment, developers need tools that can easily integrate into existing systems. Code Sight™ can seamlessly integrate into your IDE to improve productivity and eliminate security and quality issues as you write code. Organizations can also integrate and configure Coverity to scan automatically as the CI server is building the code. Coverity acts as a quality gate for projects and can fail the build if the project violates certain policies. Coverity can also be configured to notify the developers about these policy violations.

Coverity is easily integrated with your SCM of choice. For example, Coverity easily integrates into GitLab pull requests, providing additional sources of feedback and a method to easily find policy violations before code is checked in. By adding feedback from SAST into your SDLC, you provide useful guidelines to fix security defects.