Re: "Selling" a code-audit.

Dmitry Dvoinikov <[email protected]> Thu, 2 Sep 2004 12:35:35 +0600
Newsgroups gmane.comp.security.programming
Message-ID <[email protected]>
It's your job after all, not like you are out there just
to bug everyone. Therefore be friendly, backed up with a
company-level procedure and clench your teeth.

Sincerely,
Dmitry Dvoinikov
http://www.targeted.org/

--- Original message follows ---

> One of my primary responsibilities with my employer is performing code
> audits; so far I have been fairly effective in a technical capacity, however
> on almost every single code audit I have participated in I have received
> hostile responses from the development team.  I have tried a variety of
> approaches to develop a stronger rapport with the development team, however
> in spite of my best efforts I find that going into a code audit I am already
> fighting against preconceptions about why the code audit is being performed.


> I understand that many people feel threatened when work they have done is
> criticized; what I need to know is how I can minimize this and coax the
> development teams into being more interactive than defensive.  Any pointers?

> Yvan Boily