You've got some code from a team member to review. You already know that security is important, but do you know how to review their code for security issues? In this session, Rouan will equip you to find common security issues before they're shipped to production. He’ll cover eight questions you should ask yourself whenever you’re reviewing code.

1. Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues

2. Too much
pressure
Code reviews are great for
catching issues but they can’t be
the only thing.
- Build awareness 💬
- Threat modelling 🐉
- Pen testing 🔦

3. Where’s the input
going?
- Is there new input?
- Have we changed the way
input is handled?
- Where it’s stored?
- How it’s used later?
1 .

5. Are the right AAA
checks in place?
- Authentication - have we
checked the actor is who
they say they are?
- Authorisation - have we
checked they’re allowed to
do this?
- Auditing - have we made a
note of what happened?
2 .

7. Have the assets
changed?
Are we storing any personal or
special information? E.g.
- Emails
- Health info
- Credit cards
- Racial or ethnic origin
- Political or religious info
3 .

9. Are you leaking
data?
- Is your API returning extra
bits?
- Are you logging stuff you
shouldn’t?
- Don’t keep anything you
don’t need
4 .

11. Any new
dependencies?
Do some research on new
dependencies. Are they:
- Trusted
- Popular
- Well maintained
- Do you really need it?
5 .

13. Has the config
changed?
- Misconfiguration is a super
common cause of security
issues
- If your config isn’t code,
you can’t review it!
6 .

15. Is anything being
cached?
- Don’t show one user’s
sensitive info to another!
- Everyone should
understand the default
cache behaviour
- Good cache keys
7 .

16. Have you checked
the borders?
Handy trick if you’re short on
time is to focus on where data
enters and leaves your system -
e.g. where a web request comes
in and where we talk to a
database.
8 .

17. A few tricks that helped me learn
Find your
security
mentor
Turn up at
post
mortems
Smashing
Security
Podcast
Offer help
during pen
tests
Find a
security
course
online

18. 1 .
2 .
3 .
4 .
5 .
6 .
7 .
8 .
Inputs
AAA
Asset type
Data leaks
Dependencies
Boundaries
Config
Caching
Reviewing code for security issues – Cheat Sheet
@rouanw

19. Is this okay!?
Rouan Wilsenach
Engineering Lead, Haven
@rouanw
Reviewing code for security issues