From the course: Static Application Security Testing

Unlock the full course today

Join today to access over 24,400 courses taught by industry experts.

Code review models

Code review models - SonarQube Tutorial

From the course: Static Application Security Testing

Start my 1-month free trial Buy for my team

Code review models

“

- [Instructor] Regardless of whether the secure reviews of your source code are manual or fully automated, you should begin by selecting a model that's right for your organization. You could begin with an over-the-shoulder approach, for example. Literally, have a security tester look over the developer's shoulder as that developer provides a casual explanation of what the code does. As your testing program matures, you can move to a pass-around model, one where multiple people take a look at that code and provide their recommendations on changes that could improve the application's eventual security posture. If you're ready for formal, measurable testing, then a walkthrough model might be more to your liking. Have a team gather together, walk through the code as a group, and define specific changes that need to be made before that code can move forward. Full automation is really the pinnacle of this testing process…

Contents