% Wouter:  This last question might be generalised, to (web) applications in
% general, rather than this specific example of the TestCMS: ie. if you were to
% develop an application that will need to be subjected to a security review,
% would you do anything differently, given your experience in doing this, and if
% so, what and why?

After our experience doing a security review of TestCMS, there are definitely
lessons to be learned for development of easy{-}to{-}review applications.

% Mark sections of code as implementing some requirement
One could, for example, mark sections of code which treat a certain security
requirement clearly as such. This would allow for a speed up of the reviewing
process. The reviewers would still need to check if the marked section treat
what they state they do, but this would still lead to a decrease in the amount
of time spent per requirement in the OWASP guidelines.

This would be for the reason that such an approach would clearly save time in
the review, which would also increase the quality of the review and the overall
security of the application. Of course every advantage come with certain
disadvantages, and the disadvantage here is that such an approach would increase
development time. This would also require more careful planning of the
development of the application.

% Centralize user input
Another improvement which would streamline the security audit would be to
centralize the locations in which user input is handled. By doing this the whole
class of vulnerabilities which stems from the handling of user input could be
neutralized to an extent. This would be a relatively easy change in the
development process with comparatively big security benefits.

% Centralize application output
In the same category; during development the application could be designed in
such a way that all dynamic output is sanitized before outputting it to the
user. This would create another defense{-}in{-}depth layer for handling
attacker controlled input.

% Use working frameworks
To achieve the last two points one could use a framework verified to be secure,
the security reviewers could then spend less time on verifying the framework and
more on the implementation of the specific features of this application.
