{"id":342,"date":"2009-11-13T15:05:37","date_gmt":"2009-11-13T20:05:37","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=342"},"modified":"2010-02-01T19:03:55","modified_gmt":"2010-02-02T00:03:55","slug":"the-owasp-security-spending-benchmarks-project","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/","title":{"rendered":"The OWASP Security Spending Benchmarks Project"},"content":{"rendered":"<p>This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project.\u00a0 My notes are below:<\/p>\n<p>It does cost more to produce a secure product than an insecure product.<\/p>\n<p>Most people will still shop somewhere, go to a hospital, or enroll in a university after they have had a data breach.<\/p>\n<p>Why do we spend on security?\u00a0 How much should we be spending?<\/p>\n<ul>\n<li>Security imposes extra costs on organizations<\/li>\n<li>The &#8220;security tax&#8221; is relatively well knnown for network and IT security &#8211; 5 to 10% (years of Gartner, Forrester, and other studies)<\/li>\n<li>No comparable data for development or web apps<\/li>\n<li>Regualtions and contracts usually require &#8220;reasonable measures&#8221;.\u00a0 What does that mean?<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>OWASP Security Spending Benchmarks Project<\/strong><\/span><\/p>\n<ul>\n<li>20 partner organizations, many contributors<\/li>\n<li>Open process and participation<\/li>\n<li>Raw data available to community<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Reasons For Investing in Security<\/strong><\/span><\/p>\n<ul>\n<li>Contractual and Regulatory Compliance<\/li>\n<li>Incident Prevention, Risk Mitigation<\/li>\n<li>Cost of Entry<\/li>\n<li>Competitive Advantage<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Technical and Procedural Principles<\/strong><\/span><\/p>\n<ul>\n<li>Managed and Documented Systems<\/li>\n<li>Business-need access<\/li>\n<li>Minimization of sensitive data use<\/li>\n<li>Security in Design and Development<\/li>\n<li>Auditing and Monitoring<\/li>\n<li>Defense in Depth<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Specific Activities and Projects<\/strong><\/span><\/p>\n<ul>\n<li>Security Policy and Training<\/li>\n<li>DLP-Type Systems<\/li>\n<li>Internal Configurations Management<\/li>\n<li>Credential Management<\/li>\n<li>Security in Development<\/li>\n<li>Locking down internal permissions<\/li>\n<li>Secure Data Exchange<\/li>\n<li>Network Security<\/li>\n<li>Application Security Programs<\/li>\n<\/ul>\n<p><!--more--><\/p>\n<p><span style=\"text-decoration: underline;\"><strong>The 10000&#8242; View For Most Organizations<\/strong><\/span><\/p>\n<ul>\n<li>Legal and Regulatory Compliance: Because we have to<\/li>\n<li>Incident Prevention, Risk Mitigation and Cost of Entry: Because this is what everyone else does<\/li>\n<li>Competitive Advantage: Really?<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Regs are Not App Sec Friently&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Regulations, contracts, and RFPs are usually based on the notion of &#8220;reasonable effort&#8221; &#8211; state regulations, HIPAA, FTC, SEC, Red Flags Rule<\/li>\n<li>When regulations do get technical, they focus on old school security fetishes like firewalls, SSL, encryption, biometric passes and server rooms<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>A Few Examples<\/strong><\/span><\/p>\n<ul>\n<li>PCI Prioritized Approach<\/li>\n<li>Massachusetts 201 CMR 17.00<\/li>\n<li>The encryption exemption in state data breach notification laws<\/li>\n<li>HIPAA Notification Form<\/li>\n<li>Recent SEC Action<\/li>\n<li>Most of the contracts\/RFPs\/Vendor security whitepapers I have seen&#8230;<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>A Real World Example of Where Your PII Lives&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Small company with a few dozen employees sells widgets over the Internet<\/li>\n<li>Pay an outsourced team to develop a Joomla\/Drupal\/whatever site to build a widget-lovers community where users can connect.\u00a0 All sorts of PII involved in the app<\/li>\n<li>They deploy their site on a shared hosting\/VPS model and basically only interact with the App from a web admin interface<\/li>\n<li>They know a bit about the technical details of their app but not much.\u00a0 Actually, no actual web developers were really involved in the building or deployment of the app<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Here is What Company A Did&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Asked their developer team in India to develop code securely.\u00a0 Referenced OWASP Top 10 or similar list.<\/li>\n<li>Told their dev team that services and DB users needed to run with minimum privilege.\u00a0 Dev team balked.\u00a0 Company A agreed to pay a bit extra.<\/li>\n<li>&#8230;<\/li>\n<li>&#8230;<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Here&#8217;s What Company B Did&#8230;<\/strong><\/span><\/p>\n<ul>\n<li>Installed anti-virus on all employee machines<\/li>\n<li>Bought a firewall for the corporate network<\/li>\n<li>Maybe even got two-factor tokens for network access<\/li>\n<li>Made sure everything is going over SSL everywhere,.<\/li>\n<li>Put a biometric reader in the data center<\/li>\n<li>Encrypt all laptops<\/li>\n<\/ul>\n<p>Company B is more likely to be in compliance with state laws and other regulations.<\/p>\n<p>Company B is also more likely to suffer a data breach.<\/p>\n<p>So the only thing left to finance your application security program is the &#8220;reasonable spend&#8221; argument&#8230;<\/p>\n<p>As a community we need to get some consensus on what constitutes a reasonable spend&#8230;<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>About the OWASP Security Spending Benchmarks Project<\/strong><\/span><\/p>\n<ul>\n<li>First survey focused on general web application spending.<\/li>\n<li>Second survey focused on cloud computing.<\/li>\n<li>Responses currently being gathered for third survey<\/li>\n<li>Approximately 50 companies profiled in each case<\/li>\n<li>We do not collect IP addresses<\/li>\n<li>Most of the partners are security vendors<\/li>\n<li>Relatively small respondent base<\/li>\n<li>Meant to stimulate a discussion on security spending benchmarks<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Percentage of Development Headcount Spent on Security<\/strong><\/span><\/p>\n<ul>\n<li>41% had less than 2%<\/li>\n<li>20% had 5-10%<\/li>\n<li>18% didn&#8217;t know<\/li>\n<li>10% had 2-5%<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Percentage IT Budget on Web Application Security<\/strong><\/span><\/p>\n<ul>\n<li>33% don&#8217;t know<\/li>\n<li>24% had 5-10%<\/li>\n<li>12% had 1-5%<\/li>\n<li>12% had 10-20%<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Organizational Responsibility for Security Reviews<\/strong><\/span><\/p>\n<ul>\n<li>67% in IT Security<\/li>\n<\/ul>\n<p>47% of companies surveyed provide developers with security training via internal resources.<\/p>\n<ul>\n<li>Organizations that have suffered a public data breach spend more on security in the development process than those that have not.<\/li>\n<li>Web application security spending is expected to either stay flat or increase in nearly two thirds of companies<\/li>\n<li>Half of respondents consider security experience important when hiring developers<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Cloud Summary<\/strong><\/span><\/p>\n<ul>\n<li>SaaaS is in much greater use than IaaS or PaaS.<\/li>\n<li>Security spending does not change significantly as a result of cloud computing.<\/li>\n<li>Organizations are not doing their homework when it comes to cloud security.<\/li>\n<li>The risk of an undetected data breach is the greatest concern with using cloud computing, closely followed by the risk of a public data breach.<\/li>\n<li>Compliance and standards requirements related to cloud computing are not well understood.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Future of Project<\/strong><\/span><\/p>\n<ul>\n<li>Currently collecting responses for the third survey<\/li>\n<li>Partners assist in promoting survey, analyzing results, and providing strategic input<\/li>\n<li>Current status of project can always be found on OWASP website<\/li>\n<li>New partners are always welcome<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project.\u00a0 My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[343,307],"tags":[370,12,133,622,369],"class_list":["post-342","post","type-post","status-publish","format-standard","hentry","category-metrics-security","category-owasp-appsec-dc-2009","tag-benchmarks","tag-owasp","tag-project","tag-security","tag-spending"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Josh\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Web Admin Blog | Real Web Admins.  Real World Experience.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"The OWASP Security Spending Benchmarks Project | Web Admin Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2009-11-13T20:05:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2010-02-02T00:03:55+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"The OWASP Security Spending Benchmarks Project | Web Admin Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#article\",\"name\":\"The OWASP Security Spending Benchmarks Project | Web Admin Blog\",\"headline\":\"The OWASP Security Spending Benchmarks Project\",\"author\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/author\\\/jsokol\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/#organization\"},\"datePublished\":\"2009-11-13T15:05:37-06:00\",\"dateModified\":\"2010-02-01T19:03:55-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#webpage\"},\"articleSection\":\"Metrics, OWASP AppSec DC 2009, benchmarks, owasp, project, Security, spending\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.webadminblog.com\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/#listItem\",\"name\":\"Conferences\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/#listItem\",\"position\":2,\"name\":\"Conferences\",\"item\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/owasp-appsec-dc-2009\\\/#listItem\",\"name\":\"OWASP AppSec DC 2009\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/owasp-appsec-dc-2009\\\/#listItem\",\"position\":3,\"name\":\"OWASP AppSec DC 2009\",\"item\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/owasp-appsec-dc-2009\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#listItem\",\"name\":\"The OWASP Security Spending Benchmarks Project\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/#listItem\",\"name\":\"Conferences\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#listItem\",\"position\":4,\"name\":\"The OWASP Security Spending Benchmarks Project\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/category\\\/conferences\\\/owasp-appsec-dc-2009\\\/#listItem\",\"name\":\"OWASP AppSec DC 2009\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/#organization\",\"name\":\"Web Admin Blog\",\"description\":\"Real Web Admins.  Real World Experience.\",\"url\":\"https:\\\/\\\/www.webadminblog.com\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/author\\\/jsokol\\\/#author\",\"url\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/author\\\/jsokol\\\/\",\"name\":\"Josh\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/17951f69795527f90a4e9cb75ad6c9b3?s=96&d=identicon&r=pg\",\"width\":96,\"height\":96,\"caption\":\"Josh\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#webpage\",\"url\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/\",\"name\":\"The OWASP Security Spending Benchmarks Project | Web Admin Blog\",\"description\":\"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/2009\\\/11\\\/13\\\/the-owasp-security-spending-benchmarks-project\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/author\\\/jsokol\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/index.php\\\/author\\\/jsokol\\\/#author\"},\"datePublished\":\"2009-11-13T15:05:37-06:00\",\"dateModified\":\"2010-02-01T19:03:55-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/#website\",\"url\":\"https:\\\/\\\/www.webadminblog.com\\\/\",\"name\":\"Web Admin Blog\",\"description\":\"Real Web Admins.  Real World Experience.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.webadminblog.com\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"The OWASP Security Spending Benchmarks Project | Web Admin Blog","description":"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll","canonical_url":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#article","name":"The OWASP Security Spending Benchmarks Project | Web Admin Blog","headline":"The OWASP Security Spending Benchmarks Project","author":{"@id":"https:\/\/www.webadminblog.com\/index.php\/author\/jsokol\/#author"},"publisher":{"@id":"https:\/\/www.webadminblog.com\/#organization"},"datePublished":"2009-11-13T15:05:37-06:00","dateModified":"2010-02-01T19:03:55-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#webpage"},"isPartOf":{"@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#webpage"},"articleSection":"Metrics, OWASP AppSec DC 2009, benchmarks, owasp, project, Security, spending"},{"@type":"BreadcrumbList","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com#listItem","position":1,"name":"Home","item":"https:\/\/www.webadminblog.com","nextItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/#listItem","name":"Conferences"}},{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/#listItem","position":2,"name":"Conferences","item":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/#listItem","name":"OWASP AppSec DC 2009"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/#listItem","position":3,"name":"OWASP AppSec DC 2009","item":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#listItem","name":"The OWASP Security Spending Benchmarks Project"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/#listItem","name":"Conferences"}},{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#listItem","position":4,"name":"The OWASP Security Spending Benchmarks Project","previousItem":{"@type":"ListItem","@id":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/#listItem","name":"OWASP AppSec DC 2009"}}]},{"@type":"Organization","@id":"https:\/\/www.webadminblog.com\/#organization","name":"Web Admin Blog","description":"Real Web Admins.  Real World Experience.","url":"https:\/\/www.webadminblog.com\/"},{"@type":"Person","@id":"https:\/\/www.webadminblog.com\/index.php\/author\/jsokol\/#author","url":"https:\/\/www.webadminblog.com\/index.php\/author\/jsokol\/","name":"Josh","image":{"@type":"ImageObject","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/17951f69795527f90a4e9cb75ad6c9b3?s=96&d=identicon&r=pg","width":96,"height":96,"caption":"Josh"}},{"@type":"WebPage","@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#webpage","url":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/","name":"The OWASP Security Spending Benchmarks Project | Web Admin Blog","description":"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.webadminblog.com\/#website"},"breadcrumb":{"@id":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/#breadcrumblist"},"author":{"@id":"https:\/\/www.webadminblog.com\/index.php\/author\/jsokol\/#author"},"creator":{"@id":"https:\/\/www.webadminblog.com\/index.php\/author\/jsokol\/#author"},"datePublished":"2009-11-13T15:05:37-06:00","dateModified":"2010-02-01T19:03:55-06:00"},{"@type":"WebSite","@id":"https:\/\/www.webadminblog.com\/#website","url":"https:\/\/www.webadminblog.com\/","name":"Web Admin Blog","description":"Real Web Admins.  Real World Experience.","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.webadminblog.com\/#organization"}}]},"og:locale":"en_US","og:site_name":"Web Admin Blog | Real Web Admins.  Real World Experience.","og:type":"article","og:title":"The OWASP Security Spending Benchmarks Project | Web Admin Blog","og:description":"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll","og:url":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/","article:published_time":"2009-11-13T20:05:37+00:00","article:modified_time":"2010-02-02T00:03:55+00:00","twitter:card":"summary_large_image","twitter:title":"The OWASP Security Spending Benchmarks Project | Web Admin Blog","twitter:description":"This presentation was by Boaz Belboard, the Executive Director of Information Security for Wireless Generation and the Project Leader for the OWASP Security Spending Benchmarks Project. My notes are below: It does cost more to produce a secure product than an insecure product. Most people will still shop somewhere, go to a hospital, or enroll"},"aioseo_meta_data":{"post_id":"342","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2025-01-03 22:47:32","updated":"2025-07-17 07:15:29","seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.webadminblog.com\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/\" title=\"Conferences\">Conferences<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/\" title=\"OWASP AppSec DC 2009\">OWASP AppSec DC 2009<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tThe OWASP Security Spending Benchmarks Project\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.webadminblog.com"},{"label":"Conferences","link":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/"},{"label":"OWASP AppSec DC 2009","link":"https:\/\/www.webadminblog.com\/index.php\/category\/conferences\/owasp-appsec-dc-2009\/"},{"label":"The OWASP Security Spending Benchmarks Project","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/11\/13\/the-owasp-security-spending-benchmarks-project\/"}],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pfI0c-5w","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/comments?post=342"}],"version-history":[{"count":3,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342\/revisions"}],"predecessor-version":[{"id":376,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/342\/revisions\/376"}],"wp:attachment":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/media?parent=342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/categories?post=342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/tags?post=342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}