Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some companies build their own software. Others outsource software development by hiring contractors or other companies to build software they need.

When we need to build new custom software, is there any evidence whether the choice to develop in-house vs outsource software development has an effect on security? All else being equal, does developing in-house tend to lead to more secure software than hiring third parties to do the software development?

One could hypothesize that maybe outsourcing software development has a greater risk of leading to insecure software, all else being equal. Maybe when you develop in-house, you own the risk, so developers are properly incentivized to make it as secure as it needs to be -- but maybe when you outsource to a third party, since the third party doesn't operate the software and doesn't bear any of the risk during operation, maybe the third-party developer isn't sufficiently incentivized to use good security development practices and maybe you're more likely to end up with poor security (since that cuts the third party's costs). Or, rather, one could worry there might be some effect like this. But is that really what happens? Is there any evidence one way or the other? Or is there any general experience or conventional wisdom from industry about the effect on security of outsourcing vs developing in-house?

I'm especially thinking of a government agency who has to make this decision, but I imagine the question is generally applicable.

share|improve this question
1  
Outsourcing security is already what you do when buying firewall and/or vpn propretary solution (like cisco). –  F. Hauri Mar 10 at 17:01
    
@F.Hauri, I understand, but I'm not asking about outsourcing security generally. I'm talking specifically about outsourcing software development: custom development of new software (not buying existing products, not using existing SaaS solutions, not outsourcing operations or monitoring). –  D.W. Mar 10 at 21:39

2 Answers 2

up vote 3 down vote accepted

I'd say that there is nothing per se which would always lead to outsourced software being less secure than an in-house development but there are some common factors which may in practice lead to this commonly being the case

  1. Cost concerns. If a key factor in winning the work is low cost, then the risk of insecure software is likely to increase. Whichever way you cut it good software security costs money (IIRC Microsofts early SDL estimates was a 10% overhead), so where a 3rd party has to be cost competitive to win, non-functional aspects of the project (e.g. security may suffer). This leads to the second point.
  2. Failure to adequately describe the required security level in the contract. A general problem with outsourcing is that the requirement has to be clear in the contract. Things which aren't in the contract are likely not to be focused on (see point 1). Specifying exact requirements for security in a software contract is hard. Language like "it should be secure" isn't prescriptive enough to produce a good result, and the contracting company and outsourced provider are likely to have a very different idea of what "secure" is.
  3. "Market for Lemons". Along with that you have the general problem that in secure development there's a market for lemons. What's meant by this is that it's very hard for a buyer to adequately assess the security practices of a development company. There aren't really any good qualifications that can be assessed and buyers are unlikely to go to the effort of manually assessing the security knowledge of the individual developers.

All that said, I'd say that it's entirely possible for an outsourcing company to produce more secure software than an in-house team, the key would be for the buying company to actually prioritize security in a meaningful way during the purchase process, take efforts to assess the claims of the bidding companies, and have good descriptive security requirements in the contract.

share|improve this answer

As a rule of thumb involving a third party complicates security. It does not mean the product (software or otherwise) cannot be secure, but it does add another factor into the equation. Things to consider:

  1. Quality of the staff
  2. Experience of the third party in creating software with a focus on security, i.e. the organization as a whole needs the right focus, not just the programmers
  3. Budget
  4. Availability of internal resources to review code and follow up on the project
  5. Contract stipulations: if security is the priority it pays to put in measurable requirements to determine the third party delivered

To name but a few...

Bottom line: it is entirely possible to get secure software when outsourcing, and when the available programmers internally are not up to the job you have little choice. However, in my opinion there is always an added risk when outsourcing that needs to be managed properly to make it work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.