Re: "Selling" a code-audit and politics

The recognized father of the code inspection is Fagan. See:

Fagan, M.E. 1976. Design and Code Inspections to Reduce Errors in 
Program Development. IBM Systems Journal, Vol. 15, No. 3: 182-211;

http://www.research.ibm.com/journal/sj/153/ibmsj1503C.pdf

and,

http://www.mfagan.com/

If the purpose of your "code audit" is anything other than to create a 
"defect-free process" as defined by Fagan, then you are in fact 
performing a forensic investigation and you should be aware that 
anything forensic is meant to convince somebody of something -- if you 
are not clear who it is that you are trying to convince, or what it is 
that you are trying to convince them of, then stop what you're doing and 
reposition/reorient your work with help from others because you're 
already doomed. A team of engineers who want to produce more secure code 
may see value in having an audit performed, or they may choose to do the 
code review themselves as an ongoing part of the development process.

If you have to "sell" the code audit then there is no way to achieve its 
objective. If you are not willing to perform a forensic investigation on 
behalf of the people who wish to hire you because you don't like what 
they intend to do with the results of your audit, then don't accept the 
work. The business of forensics is often brutal, dirty and unpleasant, 
just like good security.

Sincerely,

Jason Coombs