Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm wondering if anyone has seen any case-studies or references from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved.

Obviously each development department is likely to be a unique case, but that doesn't tend to stop management asking roughly what the costs of a programme would be before spending a lot of time on scoping, so any information would be useful.

Edit: To start answering my own question I found this recent article which links to this aberdeen group which looks to have some interesting numbers (although frustratingly little data on the size of companies reviewed)

Edit2: Another reference here. It's a bit academic and formula heavy, but some interesting information

share|improve this question
    
I was going to point you to that study, one of the few I have seen quantifying secure at source. I did some analysis of here: rakkhis.com/2011/01/analysing-aberdeen-group-application.html –  Rakkhi May 26 '11 at 13:47
    
Great question, I actually did some work around that a few years ago for a relatively large-ish multi-national dev shop - unfortunately, I don't have any of those nmbers anymore :(. Bottom line, as expected, it was not cheap, and only saved money in the long run because they were currently paying so much on the pentest-fix-retest-refix cycle.... –  AviD Jun 5 '11 at 10:15

1 Answer 1

up vote 7 down vote accepted

Using the formulas in the book, "IT Security Metrics", you can staff your organization with application security professionals matched to the predictable number of incidents per quarter using a Poisson distribution. You could figure 100k US dollars per year for salary (doubled in most cases because of benefits and cost of business), 180k US dollars per year for 3 commercial SAST and 25k US dollars per year for 1 DAST (per person). The people and tools are very expensive. Make sure that you're not spending more than 37 percent of the assets that you are trying to protect. Remember that Veracode costs about 5-6k US dollars per app (apps in 100MB package size increments) that you send them -- and that competitor pricing is not far off from that number as well.

If you want to use an approximation, such as the ones used in regular information security, there is the Gartner-approved "6-7 percent" of total IT assets formula. For application security, you simply apply these numbers against the application development assets of an organization.

share|improve this answer
1  
@atdre isn't the big problem the predicable number of incidents? what is that in security? You could use the Verizon data breech report but that is biased again to where Verizon / secret service has been called in. Also how do you value your assets? e.g. what is 37% of your reputation? There are some brand value reports for big companies but not for most. How did you get the 37% number anyway? –  Rakkhi May 26 '11 at 15:50
2  
@Rakkhi: No, it's not a problem (see my references). You use your own data. I do not believe in brand/reputation damage, especially not as "hard costs". See the Gordon-Loeb Model -- cyber.umd.edu/research/economics.html –  atdre May 26 '11 at 20:29
1  
There is something to be said for cumulative brand damage over multiple incidents - see some banks currently, and Sony, as examples - share price is now being hit. –  Rory Alsop May 26 '11 at 23:15
1  
@Rory: I don't believe in the stock market either –  atdre May 28 '11 at 3:34
1  
@atdre - we are nihilists. We believe in nothing <The Big Lebowski) :-) –  Rory Alsop May 28 '11 at 8:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.