Search for

The Path to a Secure Application: A Source Code Security Review Checklist

This paper details the path you must follow to find and eliminate the coding errors and design flaws that expose data and put organizations at risk. Includes details of the five major vulnerability categories and an actionable source code security review checklist. Take the path to more secure software today.

Published Date: 2007-10-11

No. of Pages: 16

Summary:

The path to creating a secure application begins by rigorously testing source code for any and all vulnerabilities, to ensure the application will not compromise, or allow others to compromise, data privacy and integrity.

For companies using custom-built, outsourced, or open source applications in-house, ensuring all current and legacy code is secure, however, will be no small challenge. Detecting and eradicating security vulnerabilities has historically been extremely difficult. Many organizations relied on manual code review, which is costly and labor-intensive, as well as penetration testing, which examines only a subset of potential application vulnerabilities in an application.

While both of these approaches have their uses, automatic software vulnerability scanning tools now allow companies to approach secure code development in a more systematic, automated, and successful manner. These automatic vulnerability scanning tools greatly improve the speed and accuracy of code review, and may be integrated seamlessly into the development lifecycle. In fact, the best tools can pinpoint each vulnerability at the precise line of code and provide detailed information about the type of flaw, the risk it poses, and how to fix it.

 

The path to creating a secure application begins by rigorously testing source code for any and all vulnerabilities, to ensure the application will not compromise, or allow others to compromise, data privacy and integrity.

For companies using custom-built, outsourced, or open source applications in-house, ensuring all current and legacy code is secure, however, will be no small challenge. Detecting and eradicating security vulnerabilities has historically been extremely difficult. Many organizations relied on manual code review, which is costly and labor-intensive, as well as penetration testing, which examines only a subset of potential application vulnerabilities in an application.

While both of these approaches have their uses, automatic software vulnerability scanning tools now allow companies to approach secure code development in a more systematic, automated, and successful manner. These automatic vulnerability scanning tools greatly improve the speed and accuracy of code review, and may be integrated seamlessly into the development lifecycle. In fact, the best tools can pinpoint each vulnerability at the precise line of code and provide detailed information about the type of flaw, the risk it poses, and how to fix it.

 

 

Sponsored Content

Sign In

Please sign in and you will have access to all the content available on CIO.in

E-mail


Password




Forgotten password?

One Time Registration Only !

Register now For your free CIO.in account and avail the following key benefits:
  • Never fill up any form to download whitepapers and case studies
  • Special invitations to CIO events
  • Be the first to get CIO reports & analysis
  • CIO special offers... and much more!
Common Content

Cloud for Mission Critical

Oracle Database Cloud – Exadata Service delivers the highest performing, most cost-effective and most available platform for running Oracle Database.

Common Content

How to reduce cyber risks - A practical guide

People, processes, and technology are the three key components of all sound security strategies.This whitepaper not only highlights the high-risk areas that organizations should prioritize to secure, but also offers corresponding recommendations from a cyber-risk perspective.

Common Content

Comparison of Cloud Services

To make the comparison easier for customers, Oracle is documenting both a transaction processing and analytic workload that can be used to compare different Cloud solutions.