Re: "Selling" a code-audit.

Hi Yvan,


> One of my primary responsibilities with my employer is performing code
> audits; ... <snip> ...
> however on almost every single code audit I have participated in I have
> received hostile responses from the development team.  I have tried a

<snip> 


> I understand that many people feel threatened when work they have done
> is criticized; what I need to know is how I can minimize this and coax
> the development teams into being more interactive than defensive.  Any
> pointers?

The position you hold is one of "expert".  The role you play is one of
criticizer.  There are issues in taking this stance:

- developers aren't responsible for how securely they code.  Your audit
takes this credit/responsibility from them.

- Ultimately this is unlikely to develop skills along the lines of "light
a man a fire and warm him for a day, set the man on fire and you'll warm
him for the rest of his life"

- developers aren't necessarily in a position where they can share and
compare their software designs/implementations from a security standpoint.


Why not seek to make the developer responsible and turn the audits into
tutorial styled reviews?  Make security hardening (or similar
activity) various project phases (say one at design time and one at unit
test time) so the developers present to each other comparitive strategies
for improvement and chair this meeting.

This way, they'll come to appreciate your knowledge and see you as a
teacher and not a threat.


Good luck.

Warwick