Is it really necessary to design review before performing Code Review? Why is it so important?
I asked Security Ninja and what he replied was quite convincing. As I am new to Code Reviews I can't comment on that but his reply make thing more clear for me:
"Nilesh asked a question about the last blog post which I want to answer here. He asked whether the design review was required prior to performing the source code review. I feel like I’m sitting on the fence when I say that it depends on your SDLC and organisation but it really does. In a well structured SDLC with security integrated into each phase you could be reviewing the design a long time before the code itself. The design items have a couple of different uses in my eyes. They give you guidance when reviewing the design for an application from a security point of view and help you either sign off or reject the design. The second benefit of these checklist items is to check whether the code you are reviewing matches up to the design you signed off."
To understand the Design properly a presentation by the designer will help.The design will have already been checked for quality,the designer will have had experience explaining it to a small group and at least a minimal set of drawings (models) will have been constructed. This will allow for a concise,understandable presentation. Given the quality of the presentation, more people will understand more important details of the design.
You can find Guidelines for Conducting Design and Code Reviews here in precise format:
http://msdn.microsoft.com/en-us/library/ms182019(VS.80).aspx
I asked Security Ninja and what he replied was quite convincing. As I am new to Code Reviews I can't comment on that but his reply make thing more clear for me:
"Nilesh asked a question about the last blog post which I want to answer here. He asked whether the design review was required prior to performing the source code review. I feel like I’m sitting on the fence when I say that it depends on your SDLC and organisation but it really does. In a well structured SDLC with security integrated into each phase you could be reviewing the design a long time before the code itself. The design items have a couple of different uses in my eyes. They give you guidance when reviewing the design for an application from a security point of view and help you either sign off or reject the design. The second benefit of these checklist items is to check whether the code you are reviewing matches up to the design you signed off."
To understand the Design properly a presentation by the designer will help.The design will have already been checked for quality,the designer will have had experience explaining it to a small group and at least a minimal set of drawings (models) will have been constructed. This will allow for a concise,understandable presentation. Given the quality of the presentation, more people will understand more important details of the design.
You can find Guidelines for Conducting Design and Code Reviews here in precise format:
http://msdn.microsoft.com/en-us/library/ms182019(VS.80).aspx
Comments