Fwd: "Selling" a code-audit.

Make the code audit part of your development process. If it's part of
every project plan before it ever starts and the developers know
before they begin coding that an audit will occur, they more likely to
be less defensive.

Regards,

---------- Forwarded message ----------
From: Yvan Boily <yboily@seccuris.com>
Date: Mon, 30 Aug 2004 12:45:27 -0500
Subject: "Selling" a code-audit.
To: secprog@securityfocus.org

One of my primary responsibilities with my employer is performing code
audits; so far I have been fairly effective in a technical capacity, however
on almost every single code audit I have participated in I have received
hostile responses from the development team.  I have tried a variety of
approaches to develop a stronger rapport with the development team, however
in spite of my best efforts I find that going into a code audit I am already
fighting against preconceptions about why the code audit is being performed.

I understand that many people feel threatened when work they have done is
criticized; what I need to know is how I can minimize this and coax the
development teams into being more interactive than defensive.  Any pointers?

Yvan Boily




-- 
==============================================================================
                                John T. Cox
                          e-mail vampire77@gmail.com
                    www http://members.iglou.com/vampire
==============================================================================