What Is Secure Code Review and How Does It Work?

Sorry, not available in this language yet

English
日本語
简体中文

AI-generated code | Harness the power of AI coding assistants while managing the risks.
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Program Consolidation | Simplify your application security program.
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage Enterprise AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud.
Open Source License Compliance | Effective solutions for ensuring open source license compliance.
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality and Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators.

Static Analysis (SAST) | Analyzing code for security vulnerabilities without executing it.
Software Composition Analysis (SCA) | Analyzing software components for security and license compliance.
Dynamic Analysis (DAST) | Testing running applications for security vulnerabilities.
Interactive Analysis (IAST) | Real-time security testing during application execution.
Penetration Testing | Simulated cyberattacks to identify vulnerabilities.
Mobile Application Security Testing (MAST) | Ensuring the security of mobile applications.
Application Security Posture Management (ASPM) | Managing and improving application security posture.
Fuzz Testing Solutions | Identifying vulnerabilities by inputting random data to applications.

Automotive | Security solutions for automotive industry applications.
Financial Services | Security solutions tailored for financial services.
IoT & Embedded | Security for Internet of Things and embedded systems.
Medical Devices | Security solutions for medical devices.
Public Sector | Security solutions for government and public sector organizations.

Dev and DevOps Teams | Security tools and practices for development and DevOps teams.
Security Teams | Solutions and support for dedicated security teams.
Legal Teams | Resources and compliance tools for legal teams.

Table of Contents

What's the history of secure code review?
How does the code review process work?
Why is secure code review important?
What are the elements of secure code review?
How can Black Duck help?

Definition

Secure code review is a manual or automated process that examines an application’s source code. The goal of this examination is to identify any existing security flaws or vulnerabilities. Code review specifically looks for logic errors, examines spec implementation, and checks style guidelines, among other activities.

Automated code review is a process in which a tool automatically reviews the source code of an application, using a predefined set of rules to look for inferior code. Automated review can find issues in source code faster than identifying them manually.

Manual code review involves a human looking at source code, line by line, to find vulnerabilities. Manual code review helps to clarify the context of coding decisions. Automated tools are faster but they cannot take the developer’s intentions and general business logic into consideration. Manual review is more strategic and looks at specific issues.

What’s the history of secure code review?

In its first iterations, code review involved lengthy, time-consuming formal reviews. As development speeds increased, this longer review evolved into a more dynamic and lightweight process that keeps pace with agile and modern development methodologies.

Today, there are review tools available that easily integrate into SCM/IDEs. Tools like static application security testing (SAST) provide inputs in addition to manual reviews, helping developers find and fix vulnerabilities. These tools are compatible with numerous development environments like GitHub and GitLab, or IDEs like Eclipse and IntelliJ, so developers can work in their preferred environment.

How does the code review process work?

Code review—manual, automated, or a mixture of the two—can be initiated via an automated notification or by a human. Current best practices for performing robust and secure code review involve using manual and automated reviews together. This tandem approach catches the most potential issues.

Secure code review can occur at any time during the software development life cycle (SDLC), but it’s most impactful when performed earlier, because that’s when it’s easiest and fastest to make fixes to the code. In particular, using automated code review when developers are actually writing code allows for immediate changes as needed. Manual code review is very helpful when performed during the commit phase, or when a merge request is submitted to the repository. It also is a way to review code while taking into account business logic and developer intentions.

Automated review enables large codebases to be quickly and efficiently analyzed. Developers perform this review using either open source or commercial tools while they are coding, to help find vulnerabilities in real time. The most advanced development teams also include SAST tools, which can provide additional inputs, help find vulnerabilities, and enable developers to fix them before the code is checked in. The most successful development processes also involve developers performing their own self-reviews as they code.

Manual review involves a thorough review of the entire codebase by a senior or more experienced developer. This process can be extremely tedious and time-consuming, but it identifies flaws, such as business logic problems, that automated tools may miss. Layering in QA tests can help as well, but there are still scenarios that manual testing can miss. The best practice is a combination of automated and manual review.

Combining manual review with feedback from tools like SAST improves the overall security of the code being committed, and helps reduce the number of flaws that slip into production.

Why is secure code review important?

Secure code review is a critical process employed by the most successful development teams. It can:

Reduce the number of delivery defects found at a later stage in the SDLC
Decrease the amount of time developers spend fixing late-stage defects, thereby increasing productivity
Reduce the number of bugs and security vulnerabilities going into production
Improve consistency across codebases and increase maintainability
Improve collaboration, knowledge sharing, and developer productivity, and lessons learned can help inform future code development
Improve ROI by helping make processes faster and more secure, and use less resources and time

What are the elements of secure code review?

The key components involved in successful secure code review include:

A combination of manual and automated review
Collaboration, including sharing of knowledge and lessons learned
A study of metrics, which helps reduce defects and policy violations before merging the code

How can Black Duck help?

Black Duck is a recognized leader in the application security industry. With its state-of-the-art Coverity® SAST solution, Black Duck can help developers improve their productivity during the code review process.

In today’s modern DevOps environment, developers need tools that can easily integrate into existing systems. Code Sight™ can seamlessly integrate into your IDE to improve productivity and eliminate security and quality issues as you write code. Organizations can also integrate and configure Coverity to scan automatically as the CI server is building the code. Coverity acts as a quality gate for projects and can fail the build if the project violates certain policies. Coverity can also be configured to notify the developers about these policy violations.

Coverity is easily integrated with your SCM of choice. For example, Coverity easily integrates into GitLab pull requests, providing additional sources of feedback and a method to easily find policy violations before code is checked in. By adding feedback from SAST into your SDLC, you provide useful guidelines to fix security defects.