The automation code scanning tool can help to detect most source code security issues. However, there is still a need for high-risk modules. In addition to source code scanning tools, we will also apply blackbox or Dynamic Application Security Testing (DAST), which will be discussed in later chapters. Think like a hacker. Which modules will a hacker be interested in? What information can be most valuable to a hacker? What might be the weakest link in the whole application? The following table lists high-risk modules that require further review:
|
High-risk modules |
Security Review Focuses |
|
Authentication |
|
|
Authorization |
|