Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

As nowadays SAAS is becoming popular way of developing and deploying the applications, and I have just started working at a company providing SaaS solution for payment authorization services.

Since past few days, I have been thinking what would happen if some "unsatisfied / angry" developer write a malicious code (lets say deleting transaction table !)which would activate on some particular time (so that it would not be caught during testing process) and can create havoc for any time critical SAAS application. Any good SAAS offering comes with proper backup strategy and hence data restoration could be possible upto certain extent but it would seriously hamper the availibility of system and in turn the image with clients.

Sometimes I think this could be controlled through code reviews but I have seen that most of the times the code reviews are not done properly and such malicious logic can be camouflaged behind some complicated string manipulations.

So I am just boucing my thoughts to community for some good ideas, which could be implemented in development process to catch such malicious activities early on.

P.S. : Sometimes though I am unsatisfied / angry developer but would never do such unethical things being a coding lover.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

You're trying to solve a human problem with technology

A better approach is to make sure that code reviews are carried out responsibly. Other developers will not want to have to bear the brunt of the original developers malicious code so will quickly flag these kind of problems. Any "complex string manipulation" behaviour would have to be explained in detail and should rapidly show up.

Done well, a code review is pleasurable for both the author of the code and the reviewer(s). All the usual technical bug finding and documentation style requirements can be done automatically (think Findbugs, PMD, CPD etc) leaving just the interesting design and implementation discussions to take place.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.