Once we have a good view of the whole project, we will need to identify those modules or functions that need further manual code review. We don't just do a manual code review with high-risk modules; we do automated code scanning for all the modules, and we do a further manual code review for those high-risk modules with potentially hidden security issues that may not be easily identified by automation scanning tools.
When we are identifying high-risk modules to prioritize the whitebox source code review modules, try to think like a hacker. Which modules will interest a hacker? What information can be most valuable to a hacker? What is the weakest link out of all the applications? The following table lists typical high-risk modules that should be considered for further whitebox review:
|
High-risk modules |
Business functions |
|
Authentication |
|