RE: Charging customers on security

Hello,

Unfortunately most companies view application security from a technical
point of view.  I rarely see security considered at the requirements
phase of the project.  I would suggest that application security be
incorporated in the requirements phase so the customer knows what is
being developed and tested. 

Application security can be broken down into business (Access control
and etc...) and technical requirements (input validation and etc...).
If the customer approved the requirements then you develop your test
cases based on your requirements.  Now you can justify the cost.

With security in the requirement the customer can make their go/no go
decision based on a risk analysis.  It is their decision how they want
ot spend their budget.

Thanks,
Stan Guzik

-----Original Message-----
From: wirepair [mailto:[email protected]] 
Sent: Sunday, September 26, 2004 6:40 PM
To: [email protected]
Subject: Re: Charging customers on security

Charging for security of your own applications? That seems pretty
backwards to me. Why should
the client who buys your software with the expectation that it works and
is secure have to
pay for the fact that it isn't? So when my seat belts are broken, and my
tires randomly explode,
I have to pay the car manufacturer more money to get these features
fixed?

duh?
-wire

On Thu, 23 Sep 2004 10:16:40 -0700
  King Pang <[email protected]> wrote:
> Hello,
> 
> Our company developers Microsoft Solutions and I am responsible for
> leading the security initiative in the corporation.  I have spent a
> lot of time and effort on how we should apply security guidance to our
> product life cycle, such as adding threat modeling and doing security
> review.  But after I have convinced them that security is important,
> we brought up a discussion on how we should charge our customers.
> 
> Many of you have customer experience.  They want to pay the minimum
> and have all the features.  If they can choose not to pay, they won't.
> If we tell them threat modeling will add x human-weeks of development
> and we have to charge them x thousand dollars more, they won't pay.
> Moreover, they expect the system to be secure enough and if there is
> anything wrong, they would think that is our fault.
> 
> If any of you have any experience on dealing security with customers
> and how you would deal with this issue, please throw in two cents. Any
> comments or related articles would help too.
> 
> Warm Regards.

--
Visit Things From Another World for the best
comics, movies, toys, collectibles and more.
http://www.tfaw.com/?qt=wmf