-
Book Overview & Buying
-
Table Of Contents
Executive's Cybersecurity Program Handbook
By :
Performing code reviews can be one of the best ways to detect errors in the code base, if they are done properly. All too often I have seen great development teams produce excellent code only to fail on the reviews. Failing does not mean that the review was not happening; it should happen at every merge or pull request (PR). The failure was actually reviewing the code. Many times, throughout the day, I would hear, “Can someone please do a code review?” only to hear 5 seconds later, “All done!” What was the point in even doing a review?
Manual code reviews are not something that is really taught in college, at least not when I was there. In fact, secure coding was not something that was taught at all. We cannot blame our developers for not doing something that they were never taught. We have to teach our developers what to look for when they are performing the reviews and how to correctly modify code to make it secure.
There are a few different...