Re: "Selling" a code-audit.

In-Reply-To: <[email protected]>

Yvan,

There are many factors that can be influencing the hostile responses to your security findings.  Some you can control and others you cannot.  How is the audit being approached?  What is the objective of the audit?  Is this being forced on the development team from management?  Will there be attribution from the audit?  Are the findings presented as best practice or based on opinions?  What is the experience level of the developer(s) that is providing the feedback?  Are the comments from developers or management?  

All you can do is emphasize that you are there to help and provide guidance based on your expertise, the experience of your team and company, and that all findings are based on best practices and known issues.  Do not become defensive yourself or hostile back.  Make sure that you are getting buy-in from the development team's management.  If one of the objectives of the audit is non-attribution, then the management of the team needs to stress this before the actual findings are presented to the team.  You are there to provide your findings as a security professional and it is up to the management of that company to decide if they will accept the findings or not.

Unfortunately, you will always have someone in the room that will not agree with you.  If you achieved all the objectives of the audit and base all findings on fact, best practices and known issues, it will be hard to dispute and you have accomplished your job as a security professional.

Travis Schack
Vitalisec Inc.



>One of my primary responsibilities with my employer is performing code
>audits; so far I have been fairly effective in a technical capacity, however
>on almost every single code audit I have participated in I have received
>hostile responses from the development team.  I have tried a variety of
>approaches to develop a stronger rapport with the development team, however
>in spite of my best efforts I find that going into a code audit I am already
>fighting against preconceptions about why the code audit is being performed.
>
>
>I understand that many people feel threatened when work they have done is
>criticized; what I need to know is how I can minimize this and coax the
>development teams into being more interactive than defensive.  Any pointers?
>