Third Party Code Review? 89
An Anonymous Coward asks: "It looks like our sale-person is about to land a big contract with a very large US Bank, however there is a large catch in that the bank is demanding that we let them do a full audit on the source code of the software application we are selling them. After the recent rash of identity thefts of credit card and other personal info, they now mandate that all internet facing applications that store potentially private information have to have a full source code audit. This includes software from 3rd party vendors such as my company. They want to run our Java code through some software called Fortify (we looked up the price -- around $80,000) and also do a manual analysis of the code. This software is our company's life-blood. We would be ruined if it fell into a competitor's hands. We aren't storing private information about their customer's; all of the information can be found from government county auditor web sites. I understand their point of view, but it is a very scary step for us to take. Has anyone else done this and how did it work out?"
Give them the code (Score:5, Interesting)
Handing over the source code should be part and parcel of any non-retail software package. Like Free Software, but without all the philosophical bullshit.
It they steal your code (Score:5, Interesting)
As for the use of a $80k code audit tool. If the bank's paying for it, that's how it's going to happen. BTW, expensive niche software companies don't always like it when their quotes become public knowledge. Companies like that often try to guess what each customer is willing to pay, within reason.
Re:NDA (Score:4, Interesting)
Spot on. With that in place, no real reason to worry about the source code. The Java decompilers out there (try JAD for instance) are good enough I stopped bringing source with me and would just decompile the class files if I needed to look at something. If you think a Java class file will keep code out of your competitor's hands - you are in for a real shock.
Single you out? (Score:3, Interesting)
The system will fail security at its weakest link, whether it be your banking software or the operating system it runs on.
Re:Security with closed and open source (Score:4, Interesting)
OK, this is flamebait, but what the hell. It annoys me when people claim something is proven, without actually supplying any proof.
As a thought experiment, try this out. Start off with a software project that forks into two branches. One branch is developed with an open source model. The other branch becomes closed source. Assume that the original software project had a certain number of bugs. Now I ask you, as time goes on, which branch would contain less bugs? The closed source, or the open source?
It seems obvious to me that the open source project would quickly have its bugs fixed, because of two reasons. The coders on the project would have ego on the line, and would therefore be much more careful with publicly available code. Due to the immense availability of peer review, issues are discovered and reported much more quickly and thoroughly.
It also seems obvious that the closed source project would have many more bugs, for many different reasons. Programmers are more likely to ignore issues, because "nobody can see it". The pressure of getting a release out means that things are quickly cobbled together without much thought for security. If there is a review of code, it is not likely to be as thorough as what is available to open source.
If the code is hidden, a program is not more secure. Otherwise, how do you explain the numerous security issues found in closed source software every year?! Whoever found the bugs, didn't have access to the source, yet they were still found. And once it is found, how can you fix it? I'd say that closed source software is far more insecure than open source, because not many have access to the source.
Banking MO (Score:4, Interesting)
Government code reviews (Score:4, Interesting)
Notes from the experience:
* We requested examples of code that met specific auditing criteria, and received back several somewhat-anonymized methods, apparently taken from competitor's products. You should verify that the bank has appropriate "handling procedures" for protecting 3rd party source code.
* Our audit criteria was spelled out in an FEC ruling in decent detail. We found that 50% of the rules could be easily expressed as existing Checkstyle "checks" [http://checkstyle.sourceforge.net/ [sourceforge.net] ]; it was pretty easy to build custom "checks" to catch another 30%. We then used an Eclipse plugin [http://eclipse-cs.sourceforge.net/ [sourceforge.net] ] to get real-time highlighting of detected issues (plus Ant scripts for command-line checking).
In your case, Fortify "rulepacks" appear quite proprietary/complex, so using their product is probably your only option for pre-audit auditing. If licensing is out of the question, and you can't strike a cross-promotional bargain (i.e. you market with "Secured by Fortify", they use you as a case study, you get a discount), try and get access to the tool through the bank before the official audit, or negotiate an appropriately flexible window of time in which to address any discovered issues.
* You're not "innocent until proven guilty" in an audit. In *many* situations, we had to argue against rules that were nonsensical in Java, or false-positive issues discovered by the audit. Some we won, most we lost; we faced an uphill battle on all.
* Our auditor was apparently not fluent in Java, and flagged several issues regarding the method names on classes in java.lang.*. Be thankful for automated auditing
Good luck!