Re: "Selling" a code-audit.

On Mon, Aug 30, 2004 at 12:45:27PM -0500, Yvan Boily wrote:
| One of my primary responsibilities with my employer is performing code
| audits; so far I have been fairly effective in a technical capacity, however
| on almost every single code audit I have participated in I have received
| hostile responses from the development team.  I have tried a variety of
| approaches to develop a stronger rapport with the development team, however
| in spite of my best efforts I find that going into a code audit I am already
| fighting against preconceptions about why the code audit is being performed.
| 
| 
| I understand that many people feel threatened when work they have done is
| criticized; what I need to know is how I can minimize this and coax the
| development teams into being more interactive than defensive.  Any pointers?

Great question!

I think that you want to set a common goal, which is to avoid security
issues in the code you deploy/ship.  You need to ensure that getting
code reviewed is seen as a positive step, that their management gives
them time to fix issues that you find. 

Don't call it an audit.  Call it a review, a walk-through, or
something less agressive.  Do you know where the misconceptions come
from?  Can you spend a few minutes explaining the process and goals at
the start?

Fix some of the issues you find.  Offer to write libraries to fix
common issues.

Have you had issues that required a scramble response yet?

Adam