Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Internet Storm Center Diary 2007-09-26 InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

SDLC and Change Management

Published: 2007-09-26
Last Updated: 2007-09-26 18:48:21 UTC
by Kyle Haugsness (Version: 1)
0 comment(s)

We received several reports today of a high profile software vendor's website that had a directory traversal bug in a specific script.  And while it is fun to find these still in existence in 2007, it's probably more likely that new code was introduced or existing code was modified without the security auditors looking at it.

So how good is your change management process when it comes to code that has been security reviewed?  In most cases, reviewing the changes is just as important as performing the code audit in the first place.

0 comment(s)
Diary Archives