RE: Cost to fix bugs pre-production

[Eugene Chuvyrov <EChuvyrov () PDRestoration com>]

"Code Complete," a software development classic by Steve McConnell contains
numerous references to business, as well as programming literature on this
particular subject.  His "Rapid Development" most likely will drive the
point home too.

-----Original Message-----
From: Mark Curphey [mailto:mark () curphey com] 
Sent: Tuesday, November 25, 2003 4:01 PM
To: webappsec () securityfocus com
Subject: Cost to fix bugs pre-production 

A while back I read a research paper that compared some figures for the
financial cost of fixing an application security bug when it is in
development, pre-production and then finally in production. I have lost the
link. Does anyone know of any such papers ?

Has anyone ever seen a study of the cost of fixing a problem occurring from
code review against the cost of fixing an issue that got into production and
had to be retrofitted ?