 % Wouter:  What were the bottlenecks in doing the security review in your
 % experience?

% Only working on part of the code: 'big picture' may be missing
When we divided the work that had to be done for the security audit we
settled on giving each each member two categories to check. Then later we all
verified each other's findings.

This approach meant that everyone got very familiar with a certain
functionality of the web application. But it also created a bottleneck in
the sense that it is easy to lose overview of the application as the sum of
its parts. We feel this bottleneck is an acceptable consequence of the way we
divided the workload.

% Finding the code which handles a requirement (failing is easier than pass)
Another bottleneck we ran into when failing a requirement was not trivial, was
finding the actual code which handles a requirement. When assessing if a certain
requirement passes or fails the OWASP guidelines, one has to find the code which
implements the requirement. For many of the requirements this comes down to
finding a counterexample. In our experience there are not often very hard to
find for this specific web application. However for some requirements
counterexamples will be harder to find. For these we needed to find all the code
which touches upon this requirement and then verify it.

To summarize the previous paragraph: it is almost always easier to fail a
requirement and be sure of it, then to pass it. Because passing means that the
requirement is OK in \emph{all} cases. While failing needs only to mean that an
requirement fails in \emph{one} case.

% Verifying each other's results
The final bottleneck we like to note concerns the verifying of each other's
results. When verifying the results of your group members (colleagues) it may be
difficult to fully double-check their work. This touches upon the previous
point, for when a counterexample is giving it is trivial to see the result is
correct. However when a member of the group passes a requirement it will take
more time to verify this is the correct verdict. In the end we are confident of
our results, but this may be a bottleneck which can be addressed in the initial
organization.
