Re: ROI for secure software engineering

From: Pete Lindstrom <petelind(at)spiresecurity.com>
Date: Sat Feb 08 2003 - 01:18:13 EST

('binary' encoding is not supported, stored as-is)
In-Reply-To: <200302041951.10523.frolov@sigma.ispras.ru>

this might help: http://www.nist.gov/public_affairs/releases/n02-10.htm

It is a study about costs of poor software engineering.

Good luck.

Pete

>Received: (qmail 9482 invoked from network); 4 Feb 2003 17:41:32 -0000
>Received: from outgoing2.securityfocus.com (HELO
outgoing.securityfocus.com) (205.206.231.26)
> by mail.securityfocus.com with SMTP; 4 Feb 2003 17:41:32 -0000
>Received: from lists.securityfocus.com (lists.securityfocus.com
[205.206.231.19])
> by outgoing.securityfocus.com (Postfix) with QMQP
> id 3BF058F2F6; Tue, 4 Feb 2003 10:17:15 -0700 (MST)
>Mailing-List: contact secprog-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <secprog.list-id.securityfocus.com>
>List-Post: <mailto:secprog@securityfocus.com>
>List-Help: <mailto:secprog-help@securityfocus.com>
>List-Unsubscribe: <mailto:secprog-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:secprog-subscribe@securityfocus.com>
>Delivered-To: mailing list secprog@securityfocus.com
>Delivered-To: moderator for secprog@securityfocus.com
>Received: (qmail 29109 invoked from network); 4 Feb 2003 16:41:32 -0000
>Content-Type: text/plain;
> charset="koi8-r"
>From: Artem Frolov <frolov@sigma.ispras.ru>
>Organization: ISPRAS
>To: secprog@securityfocus.com
>Subject: ROI for secure software engineering
>Date: Tue, 4 Feb 2003 19:51:10 +0300
software
>engineering practices. Since it is impossible to create absolutely
secure
>software (let alone define what is absolutely secure) it would be good
to
>know how much to spend for developer education, code reviews and so on,
to
>reach some kind of break-even point.
security, but
>none dedicated to the finance of the secure software engineering. If you
know
>some links, please, share your knowledge.
Received on Mon Feb 10 18:27:54 2003