Ask HN: I'm now responsible of the security of a scaleup, how do I handle this? • Hacker News Board

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#11

Post by theGnuMe » Fri, Dec 23, 2022, 2:35 PM UTC

I would start with asking the auditors what they look for. They should be able to give you at least a broad checklist. They will probably try to hack into you if it is a red team.

Your huge customers should have a security standard for vendors. It is difficult to even start integrating with them if you don't pass some kind of assessment from them. If those were waived then you must have a hot product. You can also look at the standards for your customers and use those as a basis.

How do you deliver your product? If it is web based you have technical attack vectors. Do you have a safe and sanitized software delivery pipeline? A lot of web based SaaS pull from NPM, pip, etc... all of this software should be reviewed technically.

Where and how is customer data stored and transmitted. Is it encrypted at rest and in transit? Who controls passwords, are they hashed or is the it an Oauth integration?

Do you have internal controls (firewall, audit capability, permissions, separation of concerns, employee trainings, antivirus, backup procedures, ransomware procedures, disaster recovery policy) etc...

Good Luck!

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#12

Post by otoburb » Fri, Dec 23, 2022, 2:47 PM UTC

ttymck wrote: post #10

otoburb wrote: post #9

Congratulations! >> [...] now I'm "responsible", of the cybersecurity of a 30 people startup/scale-up, on top of actually building/maintaining features. >> [...] we're going to raise more money soon, but for now I'm +/- the only guy with cybersecurity experience. >> We have huge clients, a big leak/hack would be [...] disastrous for a lot of people. You've just outlined the business justification for you to be the de…

Doesn't "CSO" come with potential for personal liability in worst-case scenarios? It's not clear if OP volunteered/applied for this security role, or it was thrust upon them. If the company isn't wise enough to know they need a CSO, I have to think it's quite risky to jump headfirst into that pool. I also think this advice (the comment I'm replying to) is rather misguided. OP was asking "how do I get better at securi…

You've hit the nail on the head to what I believe is the crux of the issue: OP is "jumping headfirst" into a cybersecurity role for a 30 person company with large/important clients without considering what they will need, beyond additional hard skills, to be successful.

The background information is enormously helpful because, as you noted, it sounds like this is being thrust upon OP, but one can turn the conversation around and try to discuss what is actually needed to upgrade company security policies, infrastructure and processes -- starting with bandwidth (i.e. time). And carving out that time requires setting and managing expectations with both OP and CEO.

Perhaps my wording came across incorrectly, but "interim CSO" doesn't mean vying for a title bump (although that's one power move OP could certainly attempt), but more to bring to the CEO's attention that this role is now important enough at the company's current size that it deserves full-time attention.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#13

Post by ramimac » Fri, Dec 23, 2022, 2:50 PM UTC

There is a lot of advice in this thread that doesn't actually address your circumstances, or is just bad.

I recommend reading: 1. https://devd.me/log/posts/startup-security/ - relatively short and prescriptive 2. http://scrty.io/ - start with http://scrty.io/foundations + https://medium.com/starting-up-security/you-dont-need-a-chie... + https://medium.com/starting-up-security/starting-up-security...

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#14

Post by ellingsworth » Fri, Dec 23, 2022, 3:30 PM UTC

You might take a look at the OWASP Software Assurance Maturity Model (SAMM) for guidance on prescriptive activities you can take to improve your security posture over time. [1] There is a toolkit available that you can use to evaluate your team(s) and establish a phased roadmap. [2]

The data you gather from the assessment can help you prioritize activities for your team/org as well as provide metrics for your leadership.

You can also resource your activities with some of the OSS available from OWASP as well as join any of the projects/discussions to learn more. [3] Feel free to DM for more.

1. https://owaspsamm.org/ 2. https://owaspsamm.org/assessment/ 3. https://owasp.org/

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#15

Post by lormayna » Fri, Dec 23, 2022, 3:36 PM UTC

I have security experience mainly in big companies, but this is the approach that I will take: start to prioritize the needs. I suggest to use a threat model methodology (STRIDE or PASTA are fine) to understand what are the main assets and the risks and start protecting them. When you have identified the key assets and the risks related to them, you can start thinking about security controls (not only technical, also from an organization perspective) to reduce them or accept them in agreement with the management and stakeholders.

Starting from scratch can be difficult, because you need to setup processes and policy, maybe you can ask help for a consultant company in the first steps.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#16

Post by malyk » Fri, Dec 23, 2022, 4:20 PM UTC

You might consider starting with something like the CIS Controls Framework: https://www.cisecurity.org/controls/cis-controls-list.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#17

Post by zach_garwood » Fri, Dec 23, 2022, 4:49 PM UTC

I used to work at havocshield.com, which is sort of a walkthru service for organizational security. It's good for small companies in your situation, without any dedicated security staff.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#18

Post by d2049 » Fri, Dec 23, 2022, 5:01 PM UTC

I would hire a security consulting firm to do the work for you. This is not the kind of thing you can learn overnight, or even in a short to medium timeframe. Countless startups have experienced security teams and yet were still breached - just do a quick google search. It's unrealistic to think an inexperienced engineer can do better.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#19

Post by fillskills » Fri, Dec 23, 2022, 5:11 PM UTC

0xfaded wrote: post #6

First document every "near-miss" or risk you find. Go make the exact same argument to your CEO, $XX million start-up flatlines with a single slip up. Make it as easy as possible for your CEO to go to the company board, repeat the argument, and make an ask to shareholders for a loan to hire a security expert. Your self taught experience will help in finding the right person. Befriend the new security person and learn…

+100

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#20

Post by m3047 » Fri, Dec 23, 2022, 5:45 PM UTC

ellingsworth wrote: post #14

You might take a look at the OWASP Software Assurance Maturity Model (SAMM) for guidance on prescriptive activities you can take to improve your security posture over time. [1] There is a toolkit available that you can use to evaluate your team(s) and establish a phased roadmap. [2] The data you gather from the assessment can help you prioritize activities for your team/org as well as provide metrics for your leaders…

Yes, SAMM. I also refer to it as a list of questions to ask if you don't want the job, although some of the questions are good to ask when you get to the negotiation stage.