The correct answer is D. Peer review and approval.
Peer review and approval help prevent a single developer or insider from inserting malicious code without oversight. This practice supports separation of duties, accountability, secure software development, and change control. Requiring another qualified person to review and approve code changes increases the chance that suspicious, unauthorized, or malicious code will be identified before it enters production.
Why the other options are incorrect:
A. Code scanning for vulnerabilities
Code scanning can identify known vulnerabilities, insecure coding patterns, and some misconfigurations. However, malicious code intentionally written to appear legitimate may not always be detected by automated scanning.
B. Open-source component usage
Using open-source components does not prevent insider abuse. In fact, open-source dependencies may introduce additional supply chain risk if not properly reviewed.
C. Quality assurance testing
Quality assurance testing verifies whether software works as intended, but it may not detect intentionally malicious logic hidden in the code.
Therefore, peer review and approval is the best practice to prevent an insider from introducing malicious code into the development process.
