1 point by coderinsecurity 1 year ago flag hide 12 comments
securedeveloper 1 year ago next
Here are some best practices I've learned from my experience for secure code reviews. First, make sure to use automated code analysis tools to catch common security vulnerabilities. Second, create and enforce a secure coding policy and conduct regular security training for your team.
devopsguru 1 year ago next
Great points! I'd also add the importance of using threat modeling to identify potential security vulnerabilities early on in the development process. This can help you proactively address security issues before they become a problem.
securedeveloper 1 year ago next
Threat modeling is definitely a best practice. I'd also recommend using open source intelligence (OSINT) tools to gather information about potential threats and vulnerabilities that may impact your application.
securedeveloper 1 year ago next
OSINT tools can be very helpful in identifying potential threats and vulnerabilities. I often use Shodan to search for exposed devices and services: <https://www.shodan.io/>
devopsguru 1 year ago next
Shodan is a great tool. I also like to use Censys for more in-depth Internet-wide scanning: <https://censys.io/>
codereviewer 1 year ago prev next
Another tip I would suggest is to use static and dynamic code analysis tools to catch potential security issues. These tools can automate the process of identifying common coding mistakes that could lead to security vulnerabilities.
securedeveloper 1 year ago next
Static and dynamic code analysis tools are a must. I also like to use automated vulnerability scanning tools to identify potential security issues in my code.
devopsguru 1 year ago prev next
Here are some resources for secure code review best practices: <https://owasp.org/www-project-top-ten/2017/A3_2017-2021_Sensitive_Data_Exposure>, <https://cheatsheetseries.owasp.org/cheatsheets/Code_Review_Cheat_Sheet.html>
codereviewer 1 year ago next
Great links! I'd also recommend checking out the OWASP Proactive Controls for secure development: <https://owasp.org/www-project-proactive-controls/>
devopsguru 1 year ago prev next
Here are some automated vulnerability scanning tools to consider: <https://owasp.org/www-community/vulnerability-scanning-tools>, <https://www.zaproxy.org/>
codereviewer 1 year ago next
I've heard great things about ZAP - I'll have to check it out. I also like to use container scanning tools like Trivy to identify vulnerabilities in my Docker images: <https://github.com/aquasecurity/trivy>
codereviewer 1 year ago prev next
To summarize, here are some best practices for secure code review: 1. Use automated code analysis tools to catch common security issues, 2. Create and enforce a secure coding policy, 3. Conduct regular security training, 4. Use threat modeling, 5. Use OSINT tools, 6. Use static and dynamic code analysis tools, 7. Use automated vulnerability scanning tools. Thanks for the discussion, everyone!