Models for Assessing the Cost and Value of Software Assurance

It is not enough to simply estimate the cost of doing secure software assurance: you must also justify it from a value perspective. This paper presents IT valuation models that represent the most commonly accepted approaches to the valuation of IT and IT processes. These models can be categorized into four initial types: investment based, cost based, environmental/contextual, and quantitative estimation. However, the general conclusion is that there are only two valid ways to approach valuation of the secure software assurance process: quantitative and environmental. INTRODUCTION: ASSIGNING TANGIBLE VALUE TO A THEORETICAL PAYOFF The commonly accepted definition of software assurance is “a level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at anytime during its life cycle and that the software functions in the intended manner” [CNSS 2006]. Software assurance is a national security priority [PITAC 1999]. That is due to the common-sense fact that a computer-enabled national infrastructure is going to be as reliable as the code that underlies it [Dynes 2006, PITAC 1999]. Thus, it is easy to assume that any set of activities that increase the general level of confidence in the security and reliability of our software should be on the top of everybody’s wish list. Unfortunately, if the software assurance process is working right, the main benefit is that absolutely nothing happens [Anderson 2001, Kitchenham 1996]. And, in a world of razor-thin margins, a set of activities that drive up corporate cost without any directly identifiable return is a tough sell, no matter how seemingly practicable the principle might be [Anderson 2001, Ozment 2006, Park 2006]. The business case for software assurance is therefore contingent on finding a suitable method for valuation—one that allows managers to understand the implications of an indirect benefit such as assurance and then make “intelligent” decisions about the most feasible level of resources to commit [Anderson 2001, McGibbon 1999]. Antonio Drommi