Fwd: "Selling" a code-audit.
"John T. Cox" <[email protected]> Wed, 1 Sep 2004 17:06:47 -0400
| Newsgroups | gmane.comp.security.programming |
|---|---|
| Message-ID | <[email protected]> |
Make the code audit part of your development process. If it's part of every project plan before it ever starts and the developers know before they begin coding that an audit will occur, they more likely to be less defensive. Regards, ---------- Forwarded message ---------- From: Yvan Boily <[email protected]> Date: Mon, 30 Aug 2004 12:45:27 -0500 Subject: "Selling" a code-audit. To: [email protected] One of my primary responsibilities with my employer is performing code audits; so far I have been fairly effective in a technical capacity, however on almost every single code audit I have participated in I have received hostile responses from the development team. I have tried a variety of approaches to develop a stronger rapport with the development team, however in spite of my best efforts I find that going into a code audit I am already fighting against preconceptions about why the code audit is being performed. I understand that many people feel threatened when work they have done is criticized; what I need to know is how I can minimize this and coax the development teams into being more interactive than defensive. Any pointers? Yvan Boily -- ============================================================================== John T. Cox e-mail [email protected] www http://members.iglou.com/vampire ==============================================================================