Secure Development costs

Question

I'm wondering if anyone has seen any case-studies or references from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved.

Obviously each development department is likely to be a unique case, but that doesn't tend to stop management asking roughly what the costs of a programme would be before spending a lot of time on scoping, so any information would be useful.

Edit: To start answering my own question I found this recent article which links to this aberdeen group which looks to have some interesting numbers (although frustratingly little data on the size of companies reviewed)

Edit2: Another reference here. It's a bit academic and formula heavy, but some interesting information

Answer 1

Using the formulas in the book, "IT Security Metrics", you can staff your organization with application security professionals matched to the predictable number of incidents per quarter using a Poisson distribution. You could figure 100k US dollars per year for salary (doubled in most cases because of benefits and cost of business), 180k US dollars per year for 3 commercial SAST and 25k US dollars per year for 1 DAST (per person). The people and tools are very expensive. Make sure that you're not spending more than 37 percent of the assets that you are trying to protect. Remember that Veracode costs about 5-6k US dollars per app (apps in 100MB package size increments) that you send them -- and that competitor pricing is not far off from that number as well.

If you want to use an approximation, such as the ones used in regular information security, there is the Gartner-approved "6-7 percent" of total IT assets formula. For application security, you simply apply these numbers against the application development assets of an organization.