21

What case-studies or references are available from companies who have implemented a secure development process (eg, SDL or similar) around the cost/effort involved.

Whilst each development department is likely to be a unique case, it is still important to understand roughly what the costs of a programme would be before spending a lot of time on scoping.

Some references available are this recent article which links to this Aberdeen group which looks to have some interesting information and this reference here. It's a bit academic and formula heavy, but some interesting information

Improve this question
2
  • I was going to point you to that study, one of the few I have seen quantifying secure at source. I did some analysis of here: rakkhis.com/2011/01/analysing-aberdeen-group-application.html
    – Rakkhi
    Commented May 26, 2011 at 13:47
  • Great question, I actually did some work around that a few years ago for a relatively large-ish multi-national dev shop - unfortunately, I don't have any of those nmbers anymore :(. Bottom line, as expected, it was not cheap, and only saved money in the long run because they were currently paying so much on the pentest-fix-retest-refix cycle....
    – AviD ♦
    Commented Jun 5, 2011 at 10:15

1 Answer 1

Reset to default
10

Using the formulas in the book, "IT Security Metrics", you can staff your organization with application security professionals matched to the predictable number of incidents per quarter using a Poisson distribution. You could figure 100k US dollars per year for salary (doubled in most cases because of benefits and cost of business), 180k US dollars per year for 3 commercial SAST and 25k US dollars per year for 1 DAST (per person). The people and tools are very expensive. Make sure that you're not spending more than 37 percent of the assets that you are trying to protect. Remember that Veracode costs about 5-6k US dollars per app (apps in 100MB package size increments) that you send them -- and that competitor pricing is not far off from that number as well.

If you want to use an approximation, such as the ones used in regular information security, there is the Gartner-approved "6-7 percent" of total IT assets formula. For application security, you simply apply these numbers against the application development assets of an organization.

Improve this answer
18
  • 1
    @atdre isn't the big problem the predicable number of incidents? what is that in security? You could use the Verizon data breech report but that is biased again to where Verizon / secret service has been called in. Also how do you value your assets? e.g. what is 37% of your reputation? There are some brand value reports for big companies but not for most. How did you get the 37% number anyway?
    – Rakkhi
    Commented May 26, 2011 at 15:50
  • 2
    @Rakkhi: No, it's not a problem (see my references). You use your own data. I do not believe in brand/reputation damage, especially not as "hard costs". See the Gordon-Loeb Model -- cyber.umd.edu/research/economics.html
    – atdre
    Commented May 26, 2011 at 20:29
  • 2
    There is something to be said for cumulative brand damage over multiple incidents - see some banks currently, and Sony, as examples - share price is now being hit.
    – Rory Alsop ♦
    Commented May 26, 2011 at 23:15
  • 1
    @Rory: I don't believe in the stock market either
    – atdre
    Commented May 28, 2011 at 3:34
  • 1
    @atdre - we are nihilists. We believe in nothing <The Big Lebowski) :-)
    – Rory Alsop ♦
    Commented May 28, 2011 at 8:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .