What is a source code audit?
A source code audit is an audit of the source code of a software system. Its main aim is to find bugs, vulnerabilities such as Cross-site scripting (XSS), and technical issues with the code. This is done as part of the development process to ensure that once the software is released, it contains as few issues as possible.
How do source code audits work?
A source code audit can be done using specialized software or manually. While the end result is the same, the actual process varies considerably.
Source code analysis software, which is known as Static Application Security Testing, can be integrated into the IDE (Integrated Development Environment) – providing real-time feedback during the development cycle. While this means that it can scale well and is very good at identifying certain vulnerabilities, it does fall short in other areas. SASTs are not very good at identifying configuration issues and cannot uncover all vulnerabilities, such as logical vulnerabilities.
Manual source code audits, on the other hand, are carried out by experienced professionals. Here, audits can be static – looking at the actual source code and dynamic – looking at how the software functions. Both static and dynamic audits aim to uncover issues with the code and follow different processes to tests carried out by QA (Quality Assurance).
Manual and automated source code audits are not alternatives, but rather tools that are used in conjunction with each other to uncover different types of issues. Manual audits are good at uncovering logical vulnerabilities, while automated audits are more suited for modern web applications since these can be challenging to audit manually.
Is source code auditing better than black box scanning?
Source code auditing tools have access to the application’s source code while black box scanners, such as the popular WordPress security scanner WPScan, do not have access to the source code.
Does this make source code auditing better than black box scanning? No. Both types of tools have their pros and cons. Therefore during a complete security audit if possible both types of tools should be used.
The benefits of source code auditing
The main aim of source code auditing is to uncover issues either before the software is made public, or even during ongoing updates, thus minimizing the risk of a security incident. Source code auditing software is language-specific and is aimed at developers rather than WordPress administrators and website owners.
While you might be able to upload WordPress, theme, or plugin source code into an IDE to audit it, without development experience it might prove to be an unfruitful endeavor. Manual checks require an even greater degree of expertise.
Due to this, it’s important to choose reputable WordPress plugins for your website, thus ensuring that the plugins you choose have gone through the necessary checks before being released to the public.
