SoylentNews

MrPlow writes:

Submitted via IRC for TheMightyBuzzard

The financial benefits of finding and fixing defects throughout the software development life cycle (SDLC), starting at the very beginning, ought to make doing it a no-brainer. It is both easier and cheaper. One should build secure software from the ground up.

[...] The findings of a 2016 Forrester Research study call to mind an ancient proverb: A stitch in time saves nine. Or, in the case of software development, fixing defects early in the SDLC could reduce remediation costs by a factor of anywhere from 5 to 15.

The study set a baseline example of 5 hours of work to fix a defect in the coding/development stage. Finding and fixing that same defect in the final testing phase would take 5–7 times longer. And waiting until after the product was on the market to discover and fix the same defect would take even longer and cost 10–15 times more.

That doesn't include the potential cost of damages from a bad guy discovering the defect first and exploiting it to attack users.

And to the frequently stated worry that ongoing security testing creates intolerable delays in time to market, Forrester found the opposite: that it cuts time to market by 25%.

Hat tip to the old slashcode crew who left us some very good tools for doing exactly this.

Source: https://www.helpnetsecurity.com/2018/05/08/build-secure-software/

Original Submission