We discussed the practices of the whitebox review. To have an effective whitebox review, there is some preparation and input needed, such as the source code, threat-modeling analysis, architecture and design documents, automated static code analysis report, configurations, and the list of communication interfaces.
There are several approaches to proceed the whitebox source code review. We can use doxygen and naturaldocs to generate documents and flow diagrams from the source code. It will help us to gain an overall understanding of the source code. Then, we identify the high-risk modules to do a manual code inspection. The high-risk modules are those that handle sensitive information, security controls, or administrative functions.
During the whitebox review, it's necessary to build a checklist. This comprises some of the recommended industry practices, such as OWASP...