Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software?
I work in a team where our work is prioritized by a product owner (ala Scrum). The product owner is kind of sales driven and focuses on new functionality requested by customers and less on the infrastructure. I think I need a way to convince him that we need to spend more time on improving the security.
Of course I don't want to convince him by spreading fear and I'm not sure myself how much money we should spend on improving security. Of course, the security of our software is improved all the time but I suspect - without knowing for sure - that it would be sane to double the efforts in the area.
I have a weak memory reading about this, where something like the following was suggested:
- Think about a weak point in the security in the system
- Estimate what a succesfull attack would cost in terms of lost/dis-satisifed customers (X)
- Estimate how likely that it is that this would occur in a given year. (Y)
- Calculate how much should be spend on fixing the weak points, based on X and Y. We don't have to solve the issue immediately, but we should spend Z percent on it.