What Is Secure Code Review and How Does It Work?

Sorry, not available in this language yet

English
日本語
简体中文

AppSec SaaS Platform | Integrated, cloud-based AST solution optimized for development and DevSecOps teams.
AppSec IDE Plug-ins | Secure code as you write it in your IDE
Software Risk Management | Manage application security programs at enterprise scale
DevSecOps Integrations | Integrate AppSec tools into DevOps workflows

Static Analysis (SAST) | Address security and quality defects in code as it's being developed
Software Composition Analysis (SCA) | Secure and manage open source risks in applications and containers
Interactive Analysis (IAST) | Automate web security testing within your DevOps pipelines
Dynamic Analysis (DAST) | Continuous web application security testing in production.
Penetration Testing | Identify business-critical vulnerabilities with on-demand testing expertise.
Protocol Fuzzing | Identify defects and zero-day vulnerabilities in services and protocols

Program Strategy & Planning | Measure, scale, and optimize your AppSec program
Threat & Risk Assessments | Understand and address internal and external security risks
Security Training | Equip development teams with the skills they need to produce more secure software
Implementation & Deployment | Optimize utilization, management and deployment of AppSec tools
Security Testing Services | On-demand AppSec testing resources and expertise

Open Source & Security Audits | Comprehensive technical due diligence services for M&A

AI-generated code | Harness the power of AI coding assistants while managing the risks
API Security Testing | Manage software risks with a holistic API security testing program.
AppSec Consolidation | Simplify your application security program
Application Security Testing | Solutions to address security risks at all stages of the application life cycle.
DevSecOps | Solutions to help shift security left without slowing down your development teams.
Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end.
Manage AppSec Risk | Scale your application security program without increasing complexity or adding friction.
Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud
Open Source License Compliance | Effective solutions for ensuring open source license compliance
M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP.
Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators

Dev and DevOps Teams | Build secure software while maintaining developer productivity and pipeline velocity.
Security Teams | Align people, processes, and technology to minimize software risk and transform your business.
Legal Teams | Solutions to protect your IP and manage risk.

Financial Services | Protect sensitive customer and financial data from rapidly evolving security threats.
IoT & Embedded | Ensure your embedded and IoT devices are safe, secure, and reliable.
Automotive | Build software security & reliability into the modern connected car.
Telecommunications | Create seamless and safe mobile experiences, from silicon to software.
Aerospace & Defense | Solutions for automating mission-critical development.
Public Sector | Application security for government agencies and their suppliers.
Medical Device | Safeguard medical devices and applications.

Table of Contents

What's the history of secure code review?
How does the code review process work?
Why is secure code review important?
What are the elements of secure code review?
How can Synopsys help?

Definition

Secure code review is a manual or automated process that examines an application’s source code. The goal of this examination is to identify any existing security flaws or vulnerabilities. Code review specifically looks for logic errors, examines spec implementation, and checks style guidelines, among other activities.

Automated code review is a process in which a tool automatically reviews the source code of an application, using a predefined set of rules to look for inferior code. Automated review can find issues in source code faster than identifying them manually.

Manual code review involves a human looking at source code, line by line, to find vulnerabilities. Manual code review helps to clarify the context of coding decisions. Automated tools are faster but they cannot take the developer’s intentions and general business logic into consideration. Manual review is more strategic and looks at specific issues.

What’s the history of secure code review?

In its first iterations, code review involved lengthy, time-consuming formal reviews. As development speeds increased, this longer review evolved into a more dynamic and lightweight process that keeps pace with agile and modern development methodologies.

Today, there are review tools available that easily integrate into SCM/IDEs. Tools like static application security testing (SAST) provide inputs in addition to manual reviews, helping developers find and fix vulnerabilities. These tools are compatible with numerous development environments like GitHub and GitLab, or IDEs like Eclipse and IntelliJ, so developers can work in their preferred environment.

How does the code review process work?

Code review—manual, automated, or a mixture of the two—can be initiated via an automated notification or by a human. Current best practices for performing robust and secure code review involve using manual and automated reviews together. This tandem approach catches the most potential issues.

Secure code review can occur at any time during the software development life cycle (SDLC), but it’s most impactful when performed earlier, because that’s when it’s easiest and fastest to make fixes to the code. In particular, using automated code review when developers are actually writing code allows for immediate changes as needed. Manual code review is very helpful when performed during the commit phase, or when a merge request is submitted to the repository. It also is a way to review code while taking into account business logic and developer intentions.

Automated review enables large codebases to be quickly and efficiently analyzed. Developers perform this review using either open source or commercial tools while they are coding, to help find vulnerabilities in real time. The most advanced development teams also include SAST tools, which can provide additional inputs, help find vulnerabilities, and enable developers to fix them before the code is checked in. The most successful development processes also involve developers performing their own self-reviews as they code.

Manual review involves a thorough review of the entire codebase by a senior or more experienced developer. This process can be extremely tedious and time-consuming, but it identifies flaws, such as business logic problems, that automated tools may miss. Layering in QA tests can help as well, but there are still scenarios that manual testing can miss. The best practice is a combination of automated and manual review.

Combining manual review with feedback from tools like SAST improves the overall security of the code being committed, and helps reduce the number of flaws that slip into production.

Why is secure code review important?

Secure code review is a critical process employed by the most successful development teams. It can:

Reduce the number of delivery defects found at a later stage in the SDLC
Decrease the amount of time developers spend fixing late-stage defects, thereby increasing productivity
Reduce the number of bugs and security vulnerabilities going into production
Improve consistency across codebases and increase maintainability
Improve collaboration, knowledge sharing, and developer productivity, and lessons learned can help inform future code development
Improve ROI by helping make processes faster and more secure, and use less resources and time

What are the elements of secure code review?

The key components involved in successful secure code review include:

A combination of manual and automated review
Collaboration, including sharing of knowledge and lessons learned
A study of metrics, which helps reduce defects and policy violations before merging the code

How can Synopsys help?

Synopsys is a recognized leader in the application security industry. With its state-of-the-art Coverity® SAST solution, Synopsys can help developers improve their productivity during the code review process.

In today’s modern DevOps environment, developers need tools that can easily integrate into existing systems. Code Sight™ can seamlessly integrate into your IDE to improve productivity and eliminate security and quality issues as you write code. Organizations can also integrate and configure Coverity to scan automatically as the CI server is building the code. Coverity acts as a quality gate for projects and can fail the build if the project violates certain policies. Coverity can also be configured to notify the developers about these policy violations.

Coverity is easily integrated with your SCM of choice. For example, Coverity easily integrates into GitLab pull requests, providing additional sources of feedback and a method to easily find policy violations before code is checked in. By adding feedback from SAST into your SDLC, you provide useful guidelines to fix security defects.