alt Hacker NewsI am currently in a stalemate where I have written a proposal that is very technical. The only “business” outcome is that we clean up a massive security mess and rebase on a new consistent architecture.
My manager can’t understand the RFC, and knows that clean up projects aren’t palatable to his senior eng leadership so he keeps asking me to simplify or derive some business justification. I’ve proposed superficial ones like improving security posture etc but he wants a hard number that can be measured (yet another senior leadership mandate).
I’m kind of exasperated and honestly think it’s his job to figure this out.
Replies
The business value is the savings from the cost of a security issue times its probability
You first need to assess the risk of the current setup, and explain that the new setup will reduce the risk (which you may be able to express in monetary terms).
You could make an analogy to getting a flu vaccine. There's a small up-front cost, but you're making a bet that it will prevent or reduce the severity of a larger issue down the road. There's no guarantee that the larger issue would ever occur, but "getting the vaccine" makes it less likely to occur, and less costly if it does occur. Skipping the "vaccine" is a reasonable choice if the business is willing to incur substantial damages in the case of a large event in the future. To put hard numbers to it, you could always show numbers like "X% of our customers are likely to leave if we leak all their data to hackers", and base it on documented examples from recent history.
Write them if they do not mandate basic security right their brandy or vodkas or whatever will be served with opposite temperature they expect...
You really think it’s wrong that you need to show how it will save money in the long run? Why do you care if the software is poorly written? Because you don’t like fixing bugs? Why should they care? If you care then you need to give them a reason to care. I am not saying it doesn’t matter, I am saying you can’t just expect them to agree to do it because you don’t like it. And it seems like that is what you are saying. “Because security” is not an answer. Everything can be made more secure. Show them the risk and impact.
My feeling is it needs to be communicated non-technically, execs need to think 'what goes wrong if we dont do this', 'how much does it cost'.
Hire a hacker to exploit the security mess.
You've uncovered the kernel of the software industry- if it works well enough, don't touch it. This is why legacy software hangs around for longer than it should.