Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Saas CTO Security Checklist

sqreen.io

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Saas CTO Security Checklist

#11

Post by ejcx »

gaurx003 wrote: post #5

Great checklist. One recommendation - the checklist page has a lot of CORS policy violation and unsecure end points errors/warnings. Being that this list, and your company represent a security product, these errors undermine the credibility a little.

Those are CSP violations not CORS violations.

There are different levels of maturity with your security headers, and Sqreen's cookies are scoped to a completely different subdomain my.sqreen.io versus www.sqreen.io. It looks to me like they are doing everything right.

There is no shame in having your CSP header in Report Only. It's complicated to manage your assets, especially when using a tag manager where it's not obvious what the hell the URI/hosts are that will be loaded.

Re: Saas CTO Security Checklist

#12

Post by ploggingdev »

I wish frameworks included 2FA support in the default auth systems. While there are third party packages to add 2FA support, adding support at the framework level would help drive 2FA adoption in a major way.

Question : How would you add 2FA to a django website? Ideally TOTP + yubikey + backup code, but TOTP + backup code is also fine. The website I plan to add 2FA support will be open source and is meant to be self hosted by users, so I want to avoid SaaS solutions. I came across a couple of packages : django-two-factor-auth [0] which is based on django-otp [1]. There's pyotp [2], which will require me to integrate it into the login flow (not a good idea to be writing login flows). If anyone's using the mentioned packages in production, would be interested to hear about your experience.

[0] https://github.com/Bouke/django-two-factor-auth

[1] https://django-otp-official.readthedocs.io/en/latest/

[2] https://github.com/pyotp/pyotp

Re: Saas CTO Security Checklist

#13

Post by unclebucknasty »

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I'd add to this that there is also a culture of security that is being created from day one. It is unrealistic to purposely let things slide security-wise with the idea that you'll care about it later, and expect a healthy culture to emerge.

Going back to layer on security can be challenging, but it's even harder to retroactively layer on a way of thinking about and prioritizing security. For instance, it literally has to be that every engineer is thinking about the security implications of every design/implementation choice with the same urgency as the product features themselves. And there has to be a sense of standards, accountability and direction coming from the top.

Equifax is a good example of a company that failed in this. You look at the original incident, then consider how they made it so much worse in their response. At a certain point you start to think "is anyone even thinking about security there?" and you realize their culture is fundamentally broken in such a way that their entire organizational mindset will need to be clean-sheeted. That's a tough road.

Re: Saas CTO Security Checklist

#14

Post by paulb81 »

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I worked on this checklist and your feedback is very appreciated.

You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed.

As security professionals, we need to help entrepreneurs and educate developers find a good balance between building a business and building good security practices. This is the goal of this checklist.

We can't expect developers to spend days implementing security best practices before even having a business.

Re: Saas CTO Security Checklist

#15

Post by ggregoire »

kumarski wrote: post #3

i love stuff like this: * Goodui.org * enterpriseready.io * ixdchecklist.com

The first link has a great content but the UI could be so much better. Some suggestions:

1) adding a sidebar to give an overview of the tips and help to navigate to the ones I'm interested in

2) grouping the tips by category to make the list shorter and easier to read

Re: Saas CTO Security Checklist

#17

Post by irundebian »

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

The list is mixing different subject matters.

The security of all the information in your company should be handled by an information security management system, which is normally under the supervision of a CSO or CISO. The ISM gets established by defining (e. g. through policies) roles, processes and requirements for many problems occurring related to information security.

The security of your infrastructure should also be supervised by some management position and your infrastructure should be designed in advance to fulfill your security requirements.

The security of your software should also be supervised by some management position and your the whole software process have to be designed to produce secure software.

I don't believe this can be handled by a CTO with a basic checklist, although it includes important points which should be supervised. This list also feels kinda incomplete.

Re: Saas CTO Security Checklist

#18

Post by irundebian »

unclebucknasty wrote: post #13
tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I'd add to this that there is also a culture of security that is being created from day one. It is unrealistic to purposely let things slide security-wise with the idea that you'll care about it later, and expect a healthy culture to emerge. Going back to layer on security can be challenging, but it's even harder to retroactively layer on a way of thinking about and prioritizing security. For instance, it literally h…

That's a very important and interesting topic. Do you know any literature and standards on how to establish such a "culture of security" (afterwards)?

Re: Saas CTO Security Checklist

#19

Post by toomuchtodo »

paulb81 wrote: post #14
tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> We can't expect developers to spend days implementing security best practices before even having a business.

We absolutely can. Otherwise, expect regulation to do it (see: GDPR).

Re: Saas CTO Security Checklist

#20

Post by irundebian »

toomuchtodo wrote: post #19
paulb81 wrote: post #14

Earlier quoted context omitted.

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> We can't expect developers to spend days implementing security best practices before even having a business. We absolutely can. Otherwise, expect regulation to do it (see: GDPR).

OT-fun: You have 27007 karma points. ISO/IEC 27007 is one standard for "information security management systems auditing".
Post reply on HN