Source Code Review

Are you ready for another great chapter? I'm assuming that you like this book so far, and, if that's the case, I'm glad?. This chapter will teach you how to deal with the Source Code Review process. The source code is the heart or engine of the web application, and it must be properly constructed from a security perspective. Your role as an application security expert is to make sure that developers really respect the security patterns. After reading that, you're probably saying But Gus, I'm not good at programming. You will see my response to this later in this chapter, but for the time being, rest assured that I will do my best to help you progress in your career.

Static code analysis is another buzzword for source code review. But wait, I'm not done yet. There is another buzzword, static application security testing (SAST). This...

Programming background

Before we proceed further in this chapter, I have to address the topic of your programming background in detail to help and guide you in the right direction as regards programming languages. I was a programmer for around 10 years before I turned into a full-time cyber-security expert. I can tell you that the experience that I acquired during my programming career greatly helped me in becoming successful in the field of application security. After all, how can you give an expert advice if you've never developed a web application in your life?

Programming languages are divided into categories, and and they share a lot of similarities (more than you can imagine). Later in this chapter, I will show you the coding security checks (for web applications), but without referring to a specific one, because the checklist can be applied to any web application programming...

Enterprise secure coding guidelines

Every enterprise will need security policies to define the best practices in security for its development teams. One of these policies is secure coding. You will be the custodian of these best practice documents (or checklist) and update them through the evolution of the technology. Whenever possible, the secure coding guidelines should be shared with developers in the organization through the intranet website of the company. If this document doesn't exist, it is your job as an application security professional to make a new one and suggest it to management, and believe me, they will appreciate it big time. Some companies encourage the idea of going through secure coding training for developers to engage them in that process. You can refer to the secure coding checklist section in this chapter to get ideas on how to develop your own secure...

Static code analysis – manual scan versus automatic scan

In the preceding picture (In the previous section), you can clearly see that the manual code review will be executed when the project is ready for deployment in a typical security development lifecycle. The main idea that I need you to grasp here is that the manual scan happens after an automatic scan, so the manual code review is to spot any missing flaws that the automatic scanner didn't catch. Some people will debate this idea, and you will be surprised at the different opinions you'll get—someone might tell you that a manual scan is enough, and that they don't need a scanner, and that's too much ego because we're human, and we make mistakes no matter how good we are. On the other hand, some people will say that a scanner is enough, but according to their experience, there is always...

Secure coding checklist

I wrote this book so that you can have a bible of application security to use on a daily basis in your career. I want this book to contain practical scenarios as much as possible, such as the checklist mentioned in this section. Filling words in a book are not my style—I like actions (quick quote: planning without actions is just a dream), and the upcoming checklist contains straightforward rules that you can use both as a security guideline for developers and as a checklist for you when you manually inspect the source code:

Authentication and credentials management:

√	Authentication credentials must use TLS and not HTTP cleartext.
√	Authentication must be enforced on all pages, except the ones intended to be public.
√	The error messages (in the login page, reset password page, and registration page) should not...

Summary

Static code analysis is one of the pillars of application security, and I hope that you understood this chapter with ease. If you had any difficulty understanding the concepts of this chapter because of your lack of programming experience, then don't worry! This is the right time for you to start learning about programming in depth. Please refer to the Programming background section in this chapter for more details.

In the next chapter, we will cover all the topics necessary to execute a network infrastructure security test from start to finish successfully. Follow me and let's discover this amazing topic in depth!