Source Code Review Checklist Owasp

SOP-SEC-004: Source Code Review Checklist (OWASP)

1. Document Control & Revision History

---

2. Executive Summary & Scope

This Standard Operating Procedure (SOP) defines the institutional requirements for performing security-focused source code reviews. The objective is to identify, document, and remediate vulnerabilities within proprietary source code according to the OWASP Top 10 and ASVS standards.

Scope: Applies to all engineering teams, DevOps pipelines, and third-party contractors accessing the corporate codebase. This procedure is mandatory for all production-ready software deployments, microservices, and infrastructure-as-code (IaC) repositories.

---

3. Prerequisites & Tool Requirements

• Access Requirements: Read/Write access to the Secure Code Repository (GitHub Enterprise/GitLab).
• Required Software:
  • Static Analysis Security Testing (SAST) tools (e.g., Snyk, SonarQube, Checkmarx).
  • IDE with security plugins (e.g., VS Code + Snyk extension).
• Certifications: Reviewers must hold current internal "Security Champion" designation or CISM/CISSP certification.
• Infrastructure: Access to the secure enclave VPN and isolated audit environments.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase I: Preparation & Automated Analysis

• Ensure the latest build has passed the automated SAST pipeline.
• Verify that third-party library dependencies have been scanned for known vulnerabilities (SCA).
• Pull the latest stable branch for manual verification.

Phase II: OWASP ASVS Manual Verification

• Input Validation: Ensure all user inputs are sanitized and validated against an allow-list (ASVS V5).
• Authentication: Verify that credentials are not hardcoded and MFA is enforced on all endpoints (ASVS V2).
• Session Management: Confirm session tokens are cryptographically strong and set with HttpOnly, Secure, and SameSite flags (ASVS V3).
• Access Control: Validate that server-side authorization checks are performed for every data request (ASVS V4).
• Cryptography: Confirm usage of approved algorithms (e.g., AES-256) and secure key storage (ASVS V6).
• Logging & Monitoring: Verify that security-relevant events (failed logins, privilege changes) are recorded (ASVS V8).

Phase III: Remediation & Documentation

• Document all identified "Findings" in the Jira Security backlog.
• Assign severity levels based on CVSS 3.1 scoring.
• Confirm code changes with the developer through a mandatory "Secure Peer Review" cycle.

---

6. Quality Assurance & Verification Criteria

• Tolerance Threshold: Zero (0) "Critical" or "High" vulnerabilities allowed in production.
• Acceptance Benchmark: 100% of Findings identified in Section 5 must be closed and verified via regression testing.
• Audit Trail: Every PR must contain a signed-off security checklist attached to the merge request.

---

7. Practical Troubleshooting Scenarios

Scenario A: SAST Tool Returns "False Positive"

• Observation: SAST flags a benign function as an Injection vulnerability.
• Corrective Action: Developer must document the finding as a "False Positive" in the security portal, providing proof of input sanitization. The Lead Security Engineer must approve the exception in the SAST configuration file (e.g., snyk-ignore.yml).

Scenario B: Hardcoded API Key Detected in Commit History

• Observation: Automated scanner detects a sensitive secret in the current branch history.
• Corrective Action:
  1. Revoke the credential in the provider dashboard immediately.
  2. Purge the secret from history using git-filter-repo.
  3. Rotate the secret to a secure vault (e.g., HashiCorp Vault/AWS Secrets Manager).
  4. Issue a formal incident report to the CISO.

Scenario C: Unresolved Dependency Vulnerability

• Observation: A critical dependency (CVE-XXXX-XXXX) cannot be updated due to breaking changes.
• Corrective Action: Implement a temporary "Virtual Patch" via Web Application Firewall (WAF) rule to block the exploit vector while the engineering team schedules an emergency refactor of the dependency.