Question

A development team is preparing to release a new customer-facing web application. During the final SDLC phase, the risk practitioner notices that no source code review has been performed on modules handling authentication and payment processing. The business is pressing to deploy on schedule. Which action should the risk practitioner recommend FIRST?

Accepted Answer

Conduct a secure code review of the security-critical modules before authorizing deployment

Answer

Deploy on schedule and schedule the code review during the first maintenance window

Answer

Rely on network firewalls and web application firewalls to compensate for any code defects

Answer

Increase user acceptance testing coverage to detect any security weaknesses