Amazon is Making it Easier for Businesses to Review Source Code

Today, businesses are heavily reliant on websites and various web applications for conducting business on a daily basis. However, this is not without its risks. Some of these applications are created using a large number of user interface (UI) components and backend services. This makes it nearly impractical for a business to conduct a review of their source code for security vulnerabilities.

Amazon is hoping to change this. By creating a monitoring component, code changes are tracked and assigned weights along an end-to-end request call path, from an application frontend to the last backend service component. The weights are determined using various factors, such as sensitivity classification of data handled by the changed service, code safety history of the development team that made the change, cyclomatic complexity of the source code of the service, and other factors. This weight value is compared against a threshold and ultimately determines whether a business should initiate a security review for an application frontend or backend service.

By introducing such a monitoring component, businesses will no longer need to set aside a significant amount of resources and effort to ensure that components are included in a security review. This reduces the probability of a business overlooking vulnerabilities that can expose them to exploitation, data loss, or malicious attacks.