Enterprise Library Test Guide - Willy .Net

142
Enterprise Library Test Guide
Table 30 lists the DREAD rating for threat 12.
Table 30: Threat 12 DREAD Rating
D R E A D Total Rating
3 3 2 3 3 14 High
Performing Security Reviews
The security reviews are the final steps in ensuring that the application block follows
security best practices. The security reviews for Enterprise Library focused on the
code, access considerations, and design and deployment. All of the security reviews
had the following common characteristics:
●
●
●
●
●
Security reviews were done on small pieces of code and reviews had multiple
iterations.
Security reviews were performed in a timely manner to avoid backlogs and to
ensure that problems were discovered as early as possible.
The security reviews were performed by more than one tester and/or developer.
The reviewers were people with expertise in the pertinent areas. For example,
people with experience in cryptography performed the security reviews of cryptography
and secrets.
Security review checklists were used to make sure that all the relevant points were
covered and to serve as documentation.
FXCOP was used as the analysis tool.
Security Review Checklists
Checklists enumerate recommendations as itemized lists. The checklists included
here were used in the Enterprise Library security reviews. You can use them as models
or templates. The categories of checklists are:
●
●
●
●
●
General code review
Managed code review
Resource access
Code access
Design and deployment
General Code Review Checklist
Table 31 lists the general code review recommendations.