I was astounded at this posting this morning in Credit Union Times.

These types of offers always make me cringe when I see them. At first blush, they may seem like a good idea. Why not, after all, we all want to believe that our application is secure and we all want something for free. This certainly seems like the best of both worlds. How could this be bad?

Well, first off, security testing choices should not be based on price. They should be based on risk. The goal is to reduce the risk that any given operation (application, network, system, process, etc.) presents to the organization to a level that is manageable. Trust me, I have been in the security business for 20 years and all vendor processes are NOT created equal. Many variations exist in depth, skill level, scope, reporting capability, experience, etc. As such, selecting security testing vendors based upon price is a really really really bad idea. Matching vendors specific experience, reporting styles and technical capabilities to your environment and needs is a far better solution for too many reasons to expound upon here.

Second, the “find vulnerabilities or it’s free” mentality can really back fire for everyone involved. It’s hard enough for developers and technical teams to take their lumps from a security test when holes emerge, but to now also tie that to price makes it doubly difficult for them to take. “Great, I pay now because Tommy made some silly mistake!” is just one possibility. How do you think management may handle that? What about Tommy? Believe me, there can be long term side effects for Tommy’s career, especially if he is also blamed for breaking the team’s budget in addition to causing them to fail an audit.

Thirdly, it actually encourages the security assessment team to make mountains out of mole hills. Since they are rewarded only when they find vulnerabilities and the customer expectations of value are automatically built on severity (it’s human nature), then it certainly (even if only unconsciously) behooves the security team to note even small issues as serious security holes. In our experience, this can drastically impact the perceived risk of identified security issues in both technicians and management and has even been known to cause knee-jerk reactions and unneeded panic when reports arrive that show things like simple information leakage as “critical vulnerabilities”. Clearly, if the vendor is not extremely careful and mindful of ethical behavior among their teams, you can get serious skewed views between perceived risk and real-world risk, again primarily motivated by the need to find issues to make the engagement profitable.

Lastly, I am the first to admit that such marketing approaches simply “bother me”. They lend a certain air of “used car dealer” salesmanship to the security industry. This is hardly something that, in my opinion, our industry needs. We are already working hard to overcome the idea that many vendors have glommed onto for decades – that fear sells products. This enough challenge for us for now, so the last thing we need is for our industry to be viewed as is another marketplace full of “gimmicks”.

In my opinion, let’s stick to plain old value. My organization helps you find and manage your risk. We help you focus on the specific technical vulnerabilities in networks, systems, applications and operations that attackers could exploit to cause you damage. To do this, my company employs security engineers. These deeply skilled experts earn a wage and thus cost money. Our services are based around the idea that the work we do has value. The damages that we prevent from occurring save your company money. Some of that money pays us for our services and thus, we pay our experts. Value. End of story.

No gimmicks, sales hype or catchy marketing will ever replace value or the truth. Between you and me, I think that’s a very good thing!