Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Saas CTO Security Checklist

sqreen.io

Post reply on HN
Print view View original

21–30 of 61 posts

Re: Saas CTO Security Checklist

#21

Post by cookiecaper »

toomuchtodo wrote: post #19
paulb81 wrote: post #14

Earlier quoted context omitted.

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> We can't expect developers to spend days implementing security best practices before even having a business. We absolutely can. Otherwise, expect regulation to do it (see: GDPR).

Yeah. At the risk of digging at a raw wound and trivializing a recent tragedy, this is kind of like saying "We can't expect structural engineers to develop a fundamentally-safe construction plan right from the get-go."

If you're going to do something at all, there are some fundamental standards that you just don't risk by putting them off for later. Not saying you have to start out with all the frills, but there is a minimum acceptable standard of safety and competency that can and should be expected of any new work, and things that don't meet such standards should never exist in a form that could potentially be misconstrued as doing so. Reasonable baseline security practices are certainly part of those inviolable professional standards.

Re: Saas CTO Security Checklist

#23

Post by dsacco »

jbaviat wrote: post #10
tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

> Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money

Ehhhhhhh...I disagree.

1. Most of my clients tend closer to seed stage than to well-funded.

2. You don’t need security expertise or money to run a good bug bounty program. You can start one immediately. There are enough high quality resources available for free on the internet (that are not content marketing) that you can learn most of the important unknown unknowns.

For example, I think this is excellent reading for any young company thinking about security: https://medium.com/starting-up-security/starting-up-security...

Re: Saas CTO Security Checklist

#24

Post by technion »

Feedback: The section on password policy recommends requiring special characters and mixed case, then as a reference links Troy Hunt's article specifically recommending against that.

To be fair, I zeroed in on this because a mega corp did the same thing this morning.

Re: Saas CTO Security Checklist

#25

Post by dsacco »

paulb81 wrote: post #14
tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> As security professionals, we need to help entrepreneurs and educate developers find a good balance between building a business and building good security practices. This is the goal of this checklist.

No offense, but that’s not an answer to tptacek’s point. I can’t speak for him, but he probably agrees with this point. But that’s a soundbite - everyone would agree with that “we security professionals need to help entrepreneurs help themselves”, etc. The devil is in the details. He is critiquing the checklist’s content, not the checklist.

To make this comment constructive, I’m going to provide a link to what I personally consider very high quality advice for companies, written on the blog of Facebook and Coinbase’s former director of security:

https://medium.com/starting-up-security/starting-up-security...

Beyond that, having worked directly with many founders of early stage companies for security, I have to say I disagree that they can’t think about security early on. Resources like the series of articles I’ve linked to show how to navigate that compromise effectively.

Re: Saas CTO Security Checklist

#26

Post by doubleocherry »

As someone who has made a similar, internal checklist, I find this to be well-done. A good primer for someone who is starting their own Saas company, and is interested in understanding the scope of what it takes to implement best practices as a CTO.

Re: Saas CTO Security Checklist

#27

Post by beager »

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I would like to see each particular item tagged not as "Seed", "Series A", "Post Series A" but with more tangible events or metrics that would trigger needing to take those things seriously.

For instance:

---

"Follow an onboarding / offboarding checklist"

Do this when...

- you have ten or more employees,

- you have at least ten thousand user accounts, OR

- you have at least ten thousand dollars MRR

---

"Protect your application from DDoS attacks"

Do this when...

- you have publicly announced funding, put a major product launch or milestone in commercial press, or have publicized a key strategic hire

- a prolonged period of downtime (N minutes/breaking 3 or 4 nine availability) would have a materially adverse effect on your business

---

"Use SSL certificates to secure people using your website"

Do this when...

- you are collecting any information from visitors to your website (logins, email addresses, phone numbers)

- you would not want the traffic from sessions browsing your website to be intercepted by third parties.

Of course, a lot of these things would be obvious, but there's a chance here to make this really accessible to the security ignorant or security illiterate.

Re: Saas CTO Security Checklist

#28

Post by dsacco »

My honest opinion is that this is vacuous. I dislike being that critical but this is important. First, I don’t think it’s meaningful to segregate this list into divisions by funding milestones, and I don’t think it’s productive to have so many bullet points crowding one page for attention. Second, and more specifically, I think this list leaves a lot of the heavy lifting out of the problems to the detriment of solving them. For example:

> Encrypt all employee laptops and phones

You have two sub-problems here. Either you take endpoint security very seriously (which becomes its own much more important bullet point), or you trust employees to encrypt their devices on their own. This process should be entirely automated. My concrete criticism: mention this problem alongside endpoint security.

Accustom your team to locking their computers

This is another endpoint security problem. You should automate this enforcement across all employee computers. Even if people are fully on board with it conceptually, they will err because no one can have Constant Vigilance.

Centralize and archive your logs

Yes, but how? Provide examples. You linked to Elastic, but why not talk about tradeoffs between the Elastic stack and others? How about the tradeoff of paid infrastructure versus full open source? A build versus buy discussion is very useful here.

Evaluate your website’s basic security

There’s a messaging problem here. Your checklist doesn’t recommend bug bounties until post-Series A (!!!), partly because you have no qualified staff to review reports. Precisely how are your engineers reviewing “basic” security without basic qualifications? What defines “basic?” If they have the time and initiative to learn how to do this step, why can’t they do other steps you reserve for Series A or beyond?

Frankly, most of this list could be meaningfully reduced to prioritizing automation, endpoint security, formal processes and finding the right people to tell you your unknown unknowns very early on.

Re: Saas CTO Security Checklist

#29

Post by twunde »

irundebian wrote: post #17
tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

The list is mixing different subject matters. The security of all the information in your company should be handled by an information security management system, which is normally under the supervision of a CSO or CISO. The ISM gets established by defining (e. g. through policies) roles, processes and requirements for many problems occurring related to information security. The security of your infrastructure should…

I know very few startups that have or had a CSO/CISO. I would assume that most startups that have one, are in one of the following fields security/fintech/healthcare/education. Typically it falls on the CTO at early stage startups to ensure that appropriate security measures have been taken

Re: Saas CTO Security Checklist

#30

Post by tptacek »

dsacco wrote: post #25
paulb81 wrote: post #14

Earlier quoted context omitted.

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> As security professionals, we need to help entrepreneurs and educate developers find a good balance between building a business and building good security practices. This is the goal of this checklist. No offense, but that’s not an answer to tptacek’s point. I can’t speak for him, but he probably agrees with this point. But that’s a soundbite - everyone would agree with that “we security professionals need to help…

Everything Ryan McGeehan writes is amazing. All of it belongs with the very best startup security content on HN.
Post reply on HN