Security Basics: RE: The Return on Investment of Good Security

["Mercurio, Michael D (Dante)" <michael.mercurio () verizonbusiness com>]

The article is basically stating you get what you pay for. The problem
is the measurement of a 'good' vs. 'bad' service is not as easy as just
comparing pricing. To make your point, the vendor needs to provide
'quality' service and I'm assuming you are making the argument that your
company is the 'quality' vendor that costs more, but I have seen many
high priced vendors who did not have a clue. 

Simple example, I once found default SNMP read/write access to a bank
core switch that was missed by a previous 'nationally known quality'
vendor who charged twice as much. In order to justify a higher price,
you need to educate people on what qualifies as a 'good' vs. 'bad'
vendor besides price. 

You might want to touch on items such as:
1) Review and compare scopes of work to ensure they are both doing the
same thing.
2) Review a sample report to ensure you will be getting something of
quality back.
3) Ask for sample resumes of consultants that will be conducting the
assessment.
4) Ask to contact some references.

The items above will tell you more about a 'quality' vendor than the
price of the assessment and also provide more reasons why an assessment
will cost more.

M. Dante Mercurio, CISSP, CCNA
http://www.mercurio.ws
http://advinsecurity.wordpress.com
 

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Adriel T. Desautels
Sent: Friday, January 02, 2009 6:46 PM
To: pen-test list
Cc: security-basics () securityfocus com
Subject: The Return on Investment of Good Security

Latest blog entry for those who care. This one compares the Return on
Investment of good security services to the Return on Investment of poor
quality security services.  As usual comments and criticisms are welcome
and appreciated.

Direct link as requested:

http://snosoft.blogspot.com/2009/01/cost-of-good-security-is-fraction-of
.html


        Adriel T. Desautels
        ad_lists () netragard com
         --------------------------------------

        Subscribe to our blog
         http://snosoft.blogspot.com