Source code can be proprietary or open source, and license agreements often reflect this distinction. To identify cybersecurity vulnerabilities, insecure coding practices, and programming flaws, companies that want to mitigate security risks and support critical business functions must therefore pay closer attention to this important issue.
As a white-box testing methodology, source code review is used to identify vulnerabilities in areas where black-box or gray-box testing techniques are difficult to detect or fail, such as insecure coding practices, cryptography issues, improper exceptions, and unsafe errors or potential logic problems. Simply put, source code review focuses on the code's implementation details and the principles behind its execution. This approach is well-suited for comprehensive code review, particularly regarding defects and anomalies in atypical scenarios. Furthermore, when combined with penetration testing, it can effectively address most application vulnerabilities, a particularly relevant aspect when dealing with emerging technologies like 5G.
In a 5G network, the components are hardware and software resources, controlled by source code written by developers to support data transmission and network communication. Software-defined networking (SDN), network functions virtualization (NFV), network slicing, and several other 5G innovations are the result of this source code. In this context, source code review is an industry best practice for ensuring software cybersecurity and is widely adopted and practiced by many software vendors. Based on the CERT Specification and the Common Weaknesses Enumeration (CWE), ZTE developed a set of Secure Coding Specifications as its own standard source code review practice, which is even stricter and more rigorous. Furthermore, it is used as a mandatory measure to detect and mitigate risks.
How to perform source code review.
In short, source code review is a process that combines manual checks with automated tools. During the development process, carried out by frontline teams, code review, acceptance testing, and system testing are essential to mitigate risks. Automated static code review tools offer an efficient way to analyze source code. We integrate static code analysis tools into our development lifecycle to help developers identify defects or vulnerabilities. With the help of a manual code walkthrough, which is also a mandatory step before finalizing the source code, we can identify most false positives and false negatives.
During manual code review, it's not easy to detect errors simply by reading the code; it also requires running and analyzing it more carefully. ZTE's code review process consists of several analyses. It begins by verifying whether the overall design reflects the project's specifications and examines whether that section of code functions exactly as designed by the developers, whether its consistency is guaranteed, and whether the principles of security by design and by default have been respected.
An independent review of the source code, conducted by a second line of defense, is an additional security measure. This includes manual, line-by-line checks and the use of automated tools to further assess code quality. ZTE's Security Department and its Cybersecurity Lab comprise this second line of defense.
Developers are responsible for analyzing whether all expected characteristics are maintained in the event of unexpected errors during execution. They also perform tests and insert all possible values to verify that no errors are triggered that could be exploited by an attacker. In the event of an outage, developers check whether the code is resilient even against an unexpected attack.
We passed with flying colors the analyses carried out by several external organizations.
Earlier this year, thanks to successful collaboration with cybersecurity industry leaders, the source code for ZTE's Next Generation Routers Operating System (ROSng), which provides powerful support for the 5G transport network in terms of network protocols, was reviewed by a leading cybersecurity industry firm at the European Cybersecurity Lab in Brussels.
Meanwhile, ZTE's Elastic Network Automation Platform (ZENAP), which supports R&D implementation, commercial deployment, provisioning, and operation and maintenance of SDN/NFV/5G/IoT applications, has been reviewed by NETAS at its Italian laboratory in Rome. The test results inspired the R&D team to rethink security design and development. As a leading vendor committed to continuous product improvement, ZTE leverages all assessment results, both internal and independent, to continuously enhance its development practices.
Cybersecurity as a top priority for R&D.
Cybersecurity is always the top priority for ZTE's product R&D and service delivery. Therefore, the company continuously strives to introduce innovative methods by combining R&D with external cooperation with leading partners to further enhance cybersecurity. The telecommunications ecosystem comprises various unique and irreplaceable roles, including developers, analysts, and other professionals who work together to achieve secure source code. A secure network requires all stakeholders to collaborate to raise the bar for cybersecurity, and ZTE is committed to broader collaboration and communication to achieve a better digital future for everyone.
Author: Alessandro Bassano, director of the center and head of Cybersecurity at ZTE in Italy.