Perform source-level security review  Revision as of 20:06, 18
April 2006 by Jeff Williams (Talk | contribs)  Jump to:
navigation, search     • Find security vulnerabilities
introduced into implementation.     • Security Auditor     •
Incrementally, at the end of each implementation iteration.
Scope the engagement  It is rarely possible to look at each line
of code in a system, particularly if someone needs to understand
its relationship with every other line. Therefore, it is
important to collect as much information as feasible about the
system architecture and overall development process in order to
help scope out the areas that merit the most attention.  The
auditor should always start by collecting the most recent
documentation for the system - including requirements,
architecture, API docs, and user manuals. If previous steps in
the process were followed, the material needed to scope a
source-level security review should have already been produced
and would be included in this material. The auditor sho