It's suggested to have a checklist to do the whitebox review. A security checklist during a whitebox source code review can help the team decide what it should focus on. A typical security checklist for a code review may include critical security controls, such as authentication, data validation, authorization, session management, error handling, cryptography, logging, security configuration, administration functions, payment, money-related functions, and the handling of private data.
The reference sources of the security checklist can be from industry best practices or historical projects experiences. The contents of the checklist can be different based on the objective of the review.
Take a look at the following table:
|
Category of security checklist |
Objectives and references |
|
General security code review checklist |
The objective is to... |
