High-risk module review

The automation code scanning tool can help to detect most source code security issues. However, there is still a need for high-risk modules. In addition to source code scanning tools, we will also apply blackbox or Dynamic Application Security Testing (DAST), which will be discussed in later chapters. Think like a hacker. Which modules will a hacker be interested in? What information can be most valuable to a hacker? What might be the weakest link in the whole application? The following table lists high-risk modules that require further review:

High-risk modules	Security Review Focuses
Authentication	Accounts registration Login and CAPTCHA Password recovery or reset Password changes Identity and password storage and access control Account lockout control after multiple failures
Authorization	Sensitive resource access Administration...