Security Code Reviews

Question

Does anyone have a good checklist to use when doing a security code review? The majority of the focus will be on C# code with some TSql sprocs reviewed as well.

Answer 1

Microsoft has a .net security code review checklist here: Improving Web Application Security: Threats and Countermeasures : Code Review

The contents list looks like this:

• Performing Text Searches
• Cross-Site Scripting (XSS)
• SQL Injection
• Buffer Overflows
• Managed Code
• Code Access Security
• Unmanaged Code
• ASP.NET Pages and Controls
• Web Services
• Serviced Components
• Remoting
• Data Access Code

which seems like a decent start. 8-)

Answer 2

The OWASP top ten is a good start for developing a security checklist*:

• Cross Site Scripting (XSS)
• Injection Flaws
• Malicious File Execution
• Insecure Direct Object Reference
• Cross Site Request Forgery (CSRF)
• Information Leakage and Improper Error Handling
• Broken Authentication and Session Management
• Insecure Cryptographic Storage
• Insecure Communications
• Failure to Restrict URL Access

_{* for web applications}