Question to Christopher Steel and Ramesh Nagappan on Management

[Zafar Azeem]

Hi,

We are moving from our application from Client Server(Visual Basic) to Java J2EE. We had for long been advising the management on this. Finally they accepted because they want the customers to get supported through the web. Ours is a privately held company and are very strict on budget. How do you convince the management to allocate more budget to hire good resources for implementing sound Web security framework and good practices. Does your book cover any of these from a management perspective?

Thanks,
Zafar Azeem.

[Ramesh Nagappan]

If you need to justify your manangement...then I would recommend to read Chapter 8 - "The Alchemy of Security Design: Security Methodology, Patterns and Reality Checks".

This chapter is posted as a free sample and it is available for download at:
http://www.coresecuritypatterns.com/downloads/CoreSecurityPatterns_Ch8_Steel_Nagappan.pdf

Goodluck.

/Ramesh

[Christopher Steel]

Zafar,
Justifying the need for good developers and a solid security framework to management is often hard. It is like selling insurance, you don't need it unless something goes wrong. The best approach is to do a thorough risk analysis and spell out the liability to the company if the application is compromised. Your management then needs to make a business decision as to how much to invest in security based on the liability. By stating quantitatively the risks and liability, you have put the responsibility on your management officially. Most managers who are cognizant of the risks and the fact that it is their responsibility, will take the appropriate measures.