"Selling" a code-audit.
"Yvan Boily" <[email protected]> Mon, 30 Aug 2004 12:45:27 -0500
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <[email protected]> |
One of my primary responsibilities with my employer is performing code audits; so far I have been fairly effective in a technical capacity, however on almost every single code audit I have participated in I have received hostile responses from the development team. I have tried a variety of approaches to develop a stronger rapport with the development team, however in spite of my best efforts I find that going into a code audit I am already fighting against preconceptions about why the code audit is being performed. I understand that many people feel threatened when work they have done is criticized; what I need to know is how I can minimize this and coax the development teams into being more interactive than defensive. Any pointers? Yvan Boily