How much does a security audit cost? [closed]

Question

For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for testing. I really have no idea if an audit would cost $10-20k or well over $100k. I'm not asking for an exact quote, just a general guesstimate so that I know what to expect. If you could separate your estimates between blackbox and whitebox testing, that would also be helpful.

Edit:

I'll try to list as many factors as I can.

• Type of app: A web content management system similar to Wordpress, Joomla, or Drupal.
• Types of testing: Broad penetration testing and a scan for common vulnerabilities. Code review for additional vulnerabilities as the source code will be publicly available.
• LOC: Roughly 85,000.
• Languages: PHP, JavaScript.
• Audience for report: Developers.
• Location of testing: It can be done remotely.
• User roles are variable. They are assigned to groups and each group can be given any number of permissions. Any number of groups can be created.

I don't know what other information might be relevant. Really, I'm not looking for an ultra-specific number, just a ballpark figure like, "Based on the info you gave, you could probably expect to budget between $X and $X for a security audit." Even just a baseline price would be extremely helpful as I really have no idea what to expect.

Answer 1

Here's my rough guesstimate:

Code review:

1000 LOC = 1 hour
85000 LOC = 85 hours

Hourly rate: 100$/hr

85 hours * 100$/hr = 8500$

If your software uses an ORM and a well documented MVC framework, it can speed up the code review significantly.

Answer 2

Okay, there are a huge number of factors affecting cost and scope of a security audit, which is why it is so difficult to give you a ballpark without a lot more detail on the scope. For example:

• What type of security audit do you require?
• What do you consider black box? And why do you want it - it can increase the cost considerably.
• Are you including code review?
• What languages is the app written in?
• What audience is the report to be written for?
• What is the purpose of the test?
  Compliance, audit, certification,
  other?
• Is testing on site, remote, on
  live environment or test?
• What does the application do?
• How many user roles exist?
• etc.

See our taxonomy and extension to it. In fact, some of our other blog posts are very relevant here. Talk to your local vendors and get a quote.

Answer 3

This really depends on a lot of factors that makes final price.

Costs for source code analysis can be counted by counting lines or amount of code in Kilobytes. As far as I have seen, more popular is second method - to count by size of code. While pricing per lines may be more accurate, such approach does not eliminate unexpected things like very poorly written code, that definitely will take much more time to assess. Others additionally counts found vulnerabilities in code.

Some people might say that pricing depends on the quality of service. I would disagree and say that this is not always the case. New services needs to proof themselves and usually starts with lower prices and middle quality of audit - not only practical experience is essential, but also personal management, users support, etc. Brand services can afford higher prices. But there is also possibility when the brand service starts to skive, or newbies are capable of doing better audit than the well known brand. So, it is advisable to get some background about service, read recommendations and comments.

Also, price may depend on the country of service provider. We all do have differently developed economical environment.

Now from the perspective of source code auditor. For web applications usually whitebox and blackbox testing is combined together. There is really no need in security through obscurity in such case. But well, others may prefer to make blackbox test first and then to give access to the source code. If the source code is given, then it definitely will be tested in live environment. If you have only access to web-site, customer may provide access to server.

Summing up all of this, it is hard to define some fixed price. Customers usually do discuss all details and their future collaborative work. Process may look like this: you give code, they reply with report after some time. You may give code again and those steps may require several loops till bugs in code are vanished. That's why you often see contact form rather than pricelist.