Security Code Review SOP¶
Sub-procedure for Innovate pillar digital transformation
Overview¶
This sub-procedure defines the methodology for conducting security-focused code reviews. It covers manual code review techniques, automated scan result analysis, and vulnerability remediation guidance to ensure secure code is deployed to production.
Scope¶
Pillar: Innovate (Digital Transformation) Service Area: Secure SDLC Related Services: Penetration Testing, Application Security
Prerequisites¶
- Access to source code repository (read access minimum)
- Code review scope defined (application, modules, changes)
- Development environment setup (ability to run code)
- SAST scan results available (if applicable)
- Architecture documentation available
- Threat model available (if applicable)
Procedure¶
Step 1: Review Preparation¶
Objective: Establish review scope and context
- Scope Definition:
- Identify code to review (full app, module, PR)
- Determine review depth (quick, standard, deep)
- Set time budget based on code volume
- Identify high-risk areas (auth, data handling, crypto)
- Context Gathering:
- Review architecture documentation
- Understand data flows and trust boundaries
- Review threat model (if available)
- Identify applicable compliance requirements
- Environment Setup:
- Clone repository
- Set up development environment
- Configure IDE security plugins
- Prepare review checklist
Duration: 0.5-1 day Owner: Security Reviewer
Step 2: Automated Scan Analysis¶
Objective: Review and triage automated findings
- Retrieve Scan Results:
- SAST findings
- SCA dependency vulnerabilities
- Secrets scan results
- Linting/quality issues
- Triage Findings:
- Validate true positives
- Mark false positives (with rationale)
- Prioritize by severity and exploitability
- Group related findings
- Document Findings:
- Create finding entries with evidence
- Document remediation recommendations
- Note patterns for manual review focus
Duration: 0.5-2 days (varies by codebase size) Owner: Security Reviewer
Step 3: Manual Code Review¶
Objective: Identify vulnerabilities through manual analysis
Review code for OWASP Top 10 and common vulnerabilities:
- Injection Flaws (A03:2021):
- SQL injection
- Command injection
- LDAP injection
- XSS (reflected, stored, DOM)
- Look for: user input in queries, system calls, HTML output
- Broken Authentication (A07:2021):
- Password handling
- Session management
- MFA implementation
- Credential storage
- Sensitive Data Exposure (A02:2021):
- Encryption usage (at rest, in transit)
- PII/PHI handling
- Logging sensitive data
- Error messages exposing data
- Access Control (A01:2021):
- Authorization checks
- IDOR vulnerabilities
- Privilege escalation
- API access control
- Security Misconfiguration (A05:2021):
- Default credentials
- Debug mode enabled
- Verbose error handling
- Unnecessary features enabled
- Cryptographic Failures (A02:2021):
- Weak algorithms
- Hardcoded keys
- Improper key management
- Insufficient randomness
- Business Logic:
- Race conditions
- Workflow bypass
- Input validation
- Error handling
Duration: 1-5 days (varies by scope and complexity) Owner: Security Reviewer
Step 4: Findings Documentation¶
Objective: Document vulnerabilities with actionable guidance
For each finding, document:
- Finding Details:
- Title and severity (Critical/High/Medium/Low/Info)
- CWE identifier
- CVSS score (for CVE-related)
- File path and line numbers
- Code snippet showing vulnerability
- Description:
- What the vulnerability is
- Why it's a security risk
- Attack scenario/exploitation
- Evidence:
- Vulnerable code excerpt
- Proof of concept (if safe to demonstrate)
- Related findings
- Remediation:
- Recommended fix with code example
- Alternative solutions
- Testing guidance
- References:
- CWE, OWASP links
- Framework-specific guidance
Duration: Included in review time Owner: Security Reviewer
Step 5: Remediation Support¶
Objective: Assist developers in fixing vulnerabilities
- Findings Walkthrough:
- Present findings to development team
- Explain risks and impacts
- Answer technical questions
- Clarify remediation approaches
- Remediation Consultation:
- Review proposed fixes
- Provide guidance on best practices
- Help prioritize remediation
- Fix Verification:
- Review remediated code
- Verify fixes are complete
- Check for regression issues
- Update finding status
Duration: 0.5-2 days Owner: Security Reviewer / Developer
Step 6: Review Report¶
Objective: Deliver comprehensive review documentation
- Compile Report:
- Executive summary
- Scope and methodology
- Findings summary (by severity)
- Detailed findings
- Remediation status
- Recommendations
- Metrics:
- Total findings by severity
- Findings by category
- Code coverage reviewed
- Remediation rate
- Sign-off:
- Review complete confirmation
- Outstanding risks documented
- Recommendations for future reviews
Duration: 0.5-1 day Owner: Security Reviewer
Deliverables¶
| Deliverable | Format | Owner |
|---|---|---|
| Review Checklist (completed) | Excel/Markdown | Security Reviewer |
| Finding Entries | Jira/Issue tracker | Security Reviewer |
| Code Review Report | Word/PDF | Security Reviewer |
| Remediation Guidance | Confluence/Wiki | Security Reviewer |
| Executive Summary | PowerPoint/Email | Engagement Lead |
Quality Gates¶
- Review scope documented and approved
- Automated scan results analyzed
- Manual review completed per checklist
- All findings documented with evidence
- Remediation guidance provided
- Critical/High findings reviewed with development team
- Report delivered to stakeholders
- Remediation verification completed (if in scope)
Security Code Review Checklist¶
Authentication & Session Management¶
- Strong password policies enforced
- Secure password storage (bcrypt, Argon2)
- Session tokens properly generated
- Session timeout implemented
- Secure cookie attributes (HttpOnly, Secure, SameSite)
- MFA implementation reviewed
Authorization¶
- Access control checks on all endpoints
- IDOR protections in place
- Role-based access control implemented
- Privilege escalation protections
Input Validation¶
- All user inputs validated
- Allowlist validation preferred
- Parameterized queries used
- Output encoding applied
- File upload restrictions
Cryptography¶
- Strong algorithms used (AES-256, RSA-2048+)
- No hardcoded keys/secrets
- Proper key management
- TLS 1.2+ enforced
- Secure random number generation
Error Handling & Logging¶
- Generic error messages to users
- Detailed logging for security events
- No sensitive data in logs
- Exception handling implemented
Data Protection¶
- PII/PHI properly protected
- Data encrypted at rest
- Secure data transmission
- Data retention policies followed
Related Documents¶
Last Updated: February 2026