"Selling" a code-audit.

"Yvan Boily" <[email protected]> Mon, 30 Aug 2004 12:45:27 -0500
Newsgroups gmane.comp.security.programming
Message-ID <[email protected]>
One of my primary responsibilities with my employer is performing code
audits; so far I have been fairly effective in a technical capacity, however
on almost every single code audit I have participated in I have received
hostile responses from the development team.  I have tried a variety of
approaches to develop a stronger rapport with the development team, however
in spite of my best efforts I find that going into a code audit I am already
fighting against preconceptions about why the code audit is being performed.


I understand that many people feel threatened when work they have done is
criticized; what I need to know is how I can minimize this and coax the
development teams into being more interactive than defensive.  Any pointers?

Yvan Boily