Let me try to sum up...please correct me if I am wrong.
"We want to charge the customer for delivering secure code."
If that, in fact, is a valid summation, then I think your organization is
completely off base. Saying you want to charge for security is analogous
to charging for functionality. Of course your customers have a right to
functional, secure code. In what environment would they not? If it is
going to take X additional FTEs to deliver secure code and you need to
push out a delivery date, that's one thing...but to then say to your
customer "OH! You wanted 'secure' code? Well, that's going to cost you an
additional X thousand dollars." is just plain wrong. What are you going
to do, offer two versions of your software? I can see it now: "Brand X
Solutions Suite, Secure, $175,000" or for our budget conscious clients
"Brand X Solutions Suite, We Didn't Care When We Wrote It, $100,000"
Great business model...good luck.
Bart Lansing
Manager, Desktop Services/Lotus Notes/Incident Response
Kohl's IT
King Pang <kingpang@gmail.com> wrote on 09/23/2004 12:16:40 PM:
Hello,
Our company developers Microsoft Solutions and I am responsible for
leading the security initiative in the corporation. I have spent a
lot of time and effort on how we should apply security guidance to our
product life cycle, such as adding threat modeling and doing security
review. But after I have convinced them that security is important,
we brought up a discussion on how we should charge our customers.
Many of you have customer experience. They want to pay the minimum
and have all the features. If they can choose not to pay, they won't.
If we tell them threat modeling will add x human-weeks of development
and we have to charge them x thousand dollars more, they won't pay.
Moreover, they expect the system to be secure enough and if there is
anything wrong, they would think that is our fault.
If any of you have any experience on dealing security with customers
and how you would deal with this issue, please throw in two cents. Any
comments or related articles would help too.
Warm Regards.
