Strategies for cost efficient security evaluations

Evaluating the security of IT products is costly and complex and in order to remain competitive, organizations engaging in security evaluations must aim at cost efficient evaluations. A criteria is established and used to assess the suitability of various strategies for cost efficient security evaluations. The results suggest, not surprisingly, a dependency between strategic role of security engineering and assurance and the suitability of cost efficiency strategies. While some strategies may result in immature security engineering process, they may be most cost efficient if evaluations are not in the core of the long term product engineering strategies. On the other hand, strategic importance of assurance and security evaluations suggests that the costs of a repeatable security engineering process can be justified by long term benefits.