They are usually cases where the app was working ok in the 'insecure' state and the fixes had some nasty side effects (or where hard to implement).
But as I am planning to write a couple example of where security DOES add value (think: Amazing presentation on integrating security into the SDL), I was wondering what is the opposite of 'Security as TAX':
- Security as Bonus or just Security Bonus
- Security as Added-Value
- Security as a Good Fairy
- Security as Friend
- Security NOT as TAX
- Security as TAX Refund
- OWASP's Security
- Security Zen
- Beautiful Security
- Application Security done in a way that will not drive Developers crazy
- Here something from your best friend: Security
- SecDDev - see SecDDev - Security Driven Development
- Invisible Security or Security Invisible - see "Making Security Invisible by Becoming the Developer's Best Friends" presentation
Humm... none of them works very well...
Let me know if you have any good ideas