GigaOm Radar for Attack Surface Management: Bishop Fox Named "Leader" and "Fast Mover". Read the report to learn why

Cracking the Code: Secure Code Review in DevSecOps

On-Demand Webcast
Bishop Fox Webcast Cracking the code with Secure Code Review hosted by Chris Bush

Get security testing best practices for DevSecOps.

Application-level security is under fire. While virtually all software development life cycles include testing and validation as part of the DevOps processes, secure code review often takes a backseat to looming deadlines.

Static analysis security testing (SAST) is an important low-barrier, repeatable, and scalable secure code review practice for identifying security flaws but yields high volumes of false positives and false negatives.

On the other hand, manual secure code review is critical to validating findings and uncovering additional flaws in areas that automated tools simply cannot replicate. Unfortunately, like automated SAST, manual secure code review comes with tradeoffs of its own – namely, in the form of speed, scalability, and repeatability.

While each of these approaches play a key role in releasing secure applications, the question remains: how can DevOps teams get the best of both worlds while scaling to meet the demands of ongoing development sprints?

Watch this webcast for an in-depth look at how DevOps can integrate both automated and manual code review into the software development life cycle.

You will learn tips for:

  • Implementing security testing best practices in DevSecOps
  • Comparing automated and manual secure code review techniques
  • Leveraging secure code review/SAST in CI/CD
  • Overcoming challenges and identifying opportunities you’re likely to encounter
  • Measuring and communicating success

Chris bush

About the speaker, Chris Bush

Managing Security Consultant at Bishop Fox

Chris Bush is a managing security consultant at Bishop Fox. He has extensive experience in IT and information security consulting and solutions delivery, providing expertise in application security, including the performance of security assessments, security code reviews and penetration testing of client applications as well as development of security testing processes and methodologies.

Having been a contributing member of the information security community for many years, Chris has served as a volunteer for OWASP as a Technical Project Advisor, as an officer of the (ISC)2 Cleveland Chapter and has spoken at a variety of regional and national security conferences and user group meetings on subjects including secure coding, threat modeling, and other topics in software security. At Bishop Fox, Chris has been instrumental in creating application security thought leadership. He has authored blog posts on threat modeling in DevSecOps as well as the importance of secure code review in DevSecOps. Additionally, he has co-hosted webcasts focused on application security.

Chris is a Certified Information Systems Security Professional (CISSP) and holds a Bachelor of Science in Computer Science from the State University of New York at Buffalo and a Master of Science in Computer Science from the State University of New York at Binghamton.
More by Chris

Ready to get started? We can help.

Contact Us

This site uses cookies to provide you with a great user experience. By continuing to use our website, you consent to the use of cookies. To find out more about the cookies we use, please see our Privacy Policy.