RE: Charging customers on security

Hi,

I normally lurk, but this reminds me of a situation I was in not too
long ago.

I was building software for a stock broker (specifically, a
money-maker).  We had the usual, limited budget and a very tight
deadline.  We analyized the problem, and realized that there was no way
to securely build this software in the time allocated.  We then
immediately went back to the client and explained the situation, as well
as the lack of time to do proper security.  He said not to bother and
that he just "wanted it to work".

In my experience I've found that customers want a lot and there are
quite a few that will gladly pay fair for it, but they need to be
explained the ramifications of their decisions.  In my case, it was
simply a matter of reworking the environment that the software would be
used in to increase the security to a reasonable level.

I would suggest that if you are in the position of a contractor to your
client, that your responibility to make them understand their decisions.
If you are building software that you sell commercially, then you have
to deliver what you sell :)

Cheers,
Chris

-----Original Message-----
From: King Pang [mailto:[email protected]] 
Sent: Thursday, September 23, 2004 1:17 PM
To: [email protected]
Subject: Charging customers on security


Hello,

Our company developers Microsoft Solutions and I am responsible for
leading the security initiative in the corporation.  I have spent a
lot of time and effort on how we should apply security guidance to our
product life cycle, such as adding threat modeling and doing security
review.  But after I have convinced them that security is important,
we brought up a discussion on how we should charge our customers.

Many of you have customer experience.  They want to pay the minimum
and have all the features.  If they can choose not to pay, they won't.
If we tell them threat modeling will add x human-weeks of development
and we have to charge them x thousand dollars more, they won't pay.
Moreover, they expect the system to be secure enough and if there is
anything wrong, they would think that is our fault.

If any of you have any experience on dealing security with customers
and how you would deal with this issue, please throw in two cents. Any
comments or related articles would help too.

Warm Regards.