Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software?

I work in a team where our work is prioritized by a product owner (ala Scrum). The product owner is kind of sales driven and focuses on new functionality requested by customers and less on the infrastructure. I think I need a way to convince him that we need to spend more time on improving the security.

Of course I don't want to convince him by spreading fear and I'm not sure myself how much money we should spend on improving security. Of course, the security of our software is improved all the time but I suspect - without knowing for sure - that it would be sane to double the efforts in the area.

I have a weak memory reading about this, where something like the following was suggested:

  1. Think about a weak point in the security in the system
  2. Estimate what a succesfull attack would cost in terms of lost/dis-satisifed customers (X)
  3. Estimate how likely that it is that this would occur in a given year. (Y)
  4. Calculate how much should be spend on fixing the weak points, based on X and Y. We don't have to solve the issue immediately, but we should spend Z percent on it.
  • What sort of software is it? Do you store sensitive personal data - military data, data on identifiable individuals (health data, criminal records, bank details, credit card numbers, phone numbers, addresses)? If the answer is yes to some of the earlier points, then it's possibly a criminal offence for your boss to ignore security (depending on your jurisdiction). – MarkJ Aug 14 '13 at 15:57
  • See also how much does a security audit cost on the IT Security Stack Exchange site. Apparently it depends on many factors including program size and type, as you'd probably expect. Similarly how much does Secure Development cost – MarkJ Aug 14 '13 at 16:01
  • @MarkJ It's not always just sensitive data. Image you develop elevator controlling software and you open the door in the 55th floor while the cage is still in the 56th floor. – ott-- Aug 14 '13 at 18:36

You would probably spend as much money on the analysis as you would on just fixing the known security problems in the first place, and by following good program design and best security practices.

  1. Consider the universe of information that you may never know. When buffer overrun attacks were discovered in software written in C, nobody foresaw that happening (except the attackers). Who is expecting someone to flood a buffer with characters so that they can inject code outside its boundaries? How could you predict this, if you never saw it before?

  2. Your biggest threat is not highly-sophisticated cyber attacks, but mundane people factors. Folks who write down their passwords somewhere where they are easily accessed, because they can't remember them. Social engineering attacks. Casual use of USB flash drives. Phishing. You can't defend against these with technology, unless you...

  3. Unplug. How do government agencies deal with this kind of uncertainty? They unplug. Computers with classified information on them are kept physically and electrically isolated from the Internet and from other computers. Well, that is, until recently.

  4. You're not qualified to deal with the problem. Your expertise is not computer security (well, unless it is. But then, you're probably not writing applications, unless they are defender-type programs like virus scanners).

So what do you do? Send your people to programming-oriented security classes. Follow security and software design best practices. Learn everything you can about common security attacks, and how to defend against them. And cross your fingers.

If you still want the analysis, hire a consultant that possesses the necessary expertise.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.