Re: Charging customers on security

"the expectation that it works and is secure"

That's the problem.  There is a huge gap in the "meeting of the minds" that
is supposed to occur during software contracting.  Most buyers assume that
the code will be secure.  Most developers assume that the "requirements" are
what they are supposed to build.  Most contracts are silent on the issue and
it's not like there are a lot of industry standards here.

There's a huge amount of uncertainty here.  I don't think you want a judge
to be deciding what you really intended in your contract.  So, even if it is
a painful discussion to have, talk to your customer and work it out.  Figure
some way to share the costs of security or you'll spend far more in legal
fees.

Some more of my thoughts on this issue in this article:
http://www.owasp.org/columns/jwilliams/jwilliams4.html

BTW: the smart software developers are out there thinking, "Excellent!  What
a great way for me to distinguish myself from my competition."  Disruptions
in the market are good for the companies that can adapt.

--Jeff

Jeff Williams
Aspect Security, Inc.
http://www.aspectsecurity.com

----- Original Message ----- 
From: "wirepair" <[email protected]>
To: <[email protected]>
Sent: Sunday, September 26, 2004 6:40 PM
Subject: Re: Charging customers on security


> Charging for security of your own applications? That seems pretty
backwards to me. Why should
> the client who buys your software with the expectation that it works and
is secure have to
> pay for the fact that it isn't? So when my seat belts are broken, and my
tires randomly explode,
> I have to pay the car manufacturer more money to get these features fixed?
>
> duh?
> -wire
>
> On Thu, 23 Sep 2004 10:16:40 -0700
>   King Pang <[email protected]> wrote:
> > Hello,
> >
> > Our company developers Microsoft Solutions and I am responsible for
> > leading the security initiative in the corporation.  I have spent a
> > lot of time and effort on how we should apply security guidance to our
> > product life cycle, such as adding threat modeling and doing security
> > review.  But after I have convinced them that security is important,
> > we brought up a discussion on how we should charge our customers.
> >
> > Many of you have customer experience.  They want to pay the minimum
> > and have all the features.  If they can choose not to pay, they won't.
> > If we tell them threat modeling will add x human-weeks of development
> > and we have to charge them x thousand dollars more, they won't pay.
> > Moreover, they expect the system to be secure enough and if there is
> > anything wrong, they would think that is our fault.
> >
> > If any of you have any experience on dealing security with customers
> > and how you would deal with this issue, please throw in two cents. Any
> > comments or related articles would help too.
> >
> > Warm Regards.
>
> --
> Visit Things From Another World for the best
> comics, movies, toys, collectibles and more.
> http://www.tfaw.com/?qt=wmf