Offshore coding: Decision and Security
About the decisiveness Once the offshore coding decision is made it is made. If we want to change any, it will be more expensive. Due to the structure of the outsourced development effort, the client's choices end up quite limited. Since the client is decoupled from the individual developers on the project, the client's view of the offshore coders is an aggregate one; thus, they are either all competent or capable, or not. Thus, a client's options are to stay with the offshore coding company, or not. By contrast, an internal development team is slightly more transparent, with incompetent individuals more likely to be discovered and replaced, without replacing the entire team and starting over. Thus, corporations considering outsourcing must realize that if things go sour or don't turn out, it will be hard to cancel. Protection After making an application, it makes sense to perform a code audit for a number of practical reasons, of which one is to ensure the system is secure against accidental security bugs and deliberate back-doors. Whereas, this valuable feedback/QA technique is often skipped, for various and irrelevant reasons. When offshore coders have been employed, code audits become not only a good idea, but mandatory. While a domestic employee might undergo a background check, or face criminal penalties for deliberate subversion of software, offshore coders are usually not vetted for background anomalies, and certainly are not subject to domestic civil and criminal law. Further, the fact that offshore coders work for less money suggests that unscrupulous offshore coders can be compromised for less money. And it is profitable. A responsible project manager should not accept code from an offshore firm without a comprehensive code audit. Of course, the code audit must be performed by a competent programmer specializing in security audits, which adds substantial cost, and substantial time to the development lifecycle. A domestic development team could be used to perform its own code audit, which, combined with background checks and the pain of civil and criminal penalties, mitigates security risks for far less time, money and energy. Feed back On above all issues, quantitatively as well as qualitatively, the bottom line of the offshore coding spreadsheet is still black, it likely makes good sense to engage offshore coders in some capacity. The key point to take from this section is this: the question to ask is not "is offshore coding wrong or bad?", but rather, "will offshore coding make my shareholders richer?". However, from the length of the previous section, and the extent of the caveats, it should be clear that performing a rigorous analysis is complex and time-consuming, and the answer may very well be continue with the same work. Conclusion Many proposals are evaluated which have been floated by those who are in some way against offshore coding either as a trend or a practice. For each proposal, one or more reasons are provided explaining why it is a bad idea and should be ignored and it is needed. | 
