Source Code Review

The frequency of a Secure Code Review is determined as per the applicable industry security standards for an organization. It also depends upon the Risk Assessment results. However, as an industry best practice, it is recommended to perform these assessments at least once a year or upon a change in the environment.

Secure Code Review are typically performed using a automated techniques and technologies to identify vulnerabilities on the source code provided by the client. For Secure Code Review various commercial and open-source tools are used

OWASP Top 10, CWE/SANS 25 NIST, PCI and all applicable industry standard security frameworks are the usual standard documents that are followed for Secure Code Review.

A detailed report will be provided outlining the scope of the environment, which was tested, the methodology used, and a detailed explanation of the vulnerabilities detected along with a Proof of Concept (POC). The report will also cover detailed illustrative and possible recommendations to remediate the vulnerability.