Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Saas CTO Security Checklist

sqreen.io

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Saas CTO Security Checklist

#41

Post by jerrre »

ozim wrote: post #37
jbaviat wrote: post #10

Earlier quoted context omitted.

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

I have only one thing to nag about. Password complexity rules. Please only do length check and promote checking against dictionary passwords to be rejected. For password security this was last year hot document: https://www.nist.gov/itl/tig/projects/special-publication-80...

There could be a different between password rules for your users, and for your employees. The former should probably be more focused on usability, the latter on security.

Re: Saas CTO Security Checklist

#42

Post by dewey »

lcpriest wrote: post #39
jbaviat wrote: post #10

Earlier quoted context omitted.

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

Was this list also you? https://gdprchecklist.io/ The html is almost identical - is there a checklist-templating service that you used to build this?

> The project is inspired by The SaaS CTO Security Checklist created by Sqreen.io

Re: Saas CTO Security Checklist

#43

Post by beager »

ozim wrote: post #36
beager wrote: post #27

Earlier quoted context omitted.

I would like to see each particular item tagged not as "Seed", "Series A", "Post Series A" but with more tangible events or metrics that would trigger needing to take those things seriously. For instance: --- "Follow an onboarding / offboarding checklist" Do this when... - you have ten or more employees, - you have at least ten thousand user accounts, OR - you have at least ten thousand dollars MRR --- "Protect your…

For SSL I think there is industry consensus to push for HTTPS everywhere. There is no argument to skip it. With free lets encrypt certificates. It is not like you will spend a week implementing it, without prior experience decent developer should have it up and running in half of day.

I agree with you, maybe the advice should be “do this immediately, regardless of stage or size”

Re: Saas CTO Security Checklist

#44

Post by marcinzm »

dsacco wrote: post #28

My honest opinion is that this is vacuous. I dislike being that critical but this is important. First, I don’t think it’s meaningful to segregate this list into divisions by funding milestones, and I don’t think it’s productive to have so many bullet points crowding one page for attention. Second, and more specifically, I think this list leaves a lot of the heavy lifting out of the problems to the detriment of solvin…

>You have two sub-problems here. Either you take endpoint security very seriously (which becomes its own much more important bullet point), or you trust employees to encrypt their devices on their own. This process should be entirely automated. My concrete criticism: mention this problem alongside endpoint security.

Do you have any recommendations for endpoint security? I'm setting that up now and finding a good vendor has been annoying.

>Precisely how are your engineers reviewing “basic” security without basic qualifications?

There are standards and checklists for this (ie: OWASP Top Ten). Being able to read and follow a simple checklist, that someone recommends to you, doesn't mean you're even close to an expert in that area. That said, the OWASP Top 10 includes "Logging and Monitoring" on it while this checklist punts it to Series A, so it's confusing.

Re: Saas CTO Security Checklist

#45

Post by pfalke »

Slightly OT: Can someone elaborate on "Do not share Wifi"? What can be problematic when using a shared but encrypted (say, WPA2 with pre-shared key) Wifi?

This is a common setup in public places like cafes. I've always wondered in what ways this can cause problems.

Re: Saas CTO Security Checklist

#46

Post by finaliteration »

pfalke wrote: post #45

Slightly OT: Can someone elaborate on "Do not share Wifi"? What can be problematic when using a shared but encrypted (say, WPA2 with pre-shared key) Wifi? This is a common setup in public places like cafes. I've always wondered in what ways this can cause problems.

I think they meant, “don’t have internal and guest WiFi connections use the same subnet”. If you’re giving non-employees passwords and access to a network that contains sensitive resources that’s a big security red flag.

Many companies also use IP whitelisting for external services/systems, so if someone from outside the company joins an internal network they now have access to them as well.

Edit: Actually, they point out those exact reasons if you expand that entry in the list.

Re: Saas CTO Security Checklist

#47

Post by ozim »

jerrre wrote: post #41
ozim wrote: post #37

Earlier quoted context omitted.

I have only one thing to nag about. Password complexity rules. Please only do length check and promote checking against dictionary passwords to be rejected. For password security this was last year hot document: https://www.nist.gov/itl/tig/projects/special-publication-80...

There could be a different between password rules for your users, and for your employees. The former should probably be more focused on usability, the latter on security.

Sounds reasonable, since you can (and should) enforce use of password manager by your employees.

Re: Saas CTO Security Checklist

#48

Post by wglb »

irundebian wrote: post #18
unclebucknasty wrote: post #13

Earlier quoted context omitted.

I'd add to this that there is also a culture of security that is being created from day one. It is unrealistic to purposely let things slide security-wise with the idea that you'll care about it later, and expect a healthy culture to emerge. Going back to layer on security can be challenging, but it's even harder to retroactively layer on a way of thinking about and prioritizing security. For instance, it literally h…

That's a very important and interesting topic. Do you know any literature and standards on how to establish such a "culture of security" (afterwards)?

The thing that became evident to me with this breach and the long-delayed response from Uber about their breach was the the following is one way to look at a company's ability to deal with the reality of the internet.

First, there is the overall company culture. If employees, top to bottom, care about the company, its mission, and what they are doing day to day, it makes it feasible to introduce a security culture.

Secondly, technical competence, top to bottom. Not understanding the importance of patching (didn't they tell congress that it was too hard?), or the fact that that your customer outreach web site should be part of your already existing domain, as opposed to a totally independent easily spoofable domain that can even fool your social media guy.

Third, a serious security team. Penetration testing, security awareness training, logging/monitoring. But a crack security team is hard-pressed to overcome weakness in the other two.

This all clearly starts at the top.

Re: Saas CTO Security Checklist

#49

Post by wglb »

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

One thing missing from all these is a basic anti-phishing training for top folks in the company. Be sure that they who control financial string have a pre-agreed non-email pattern of, for example, CEO telling CFO to transfer money.

Re: Saas CTO Security Checklist

#50

Post by nickpsecurity »

toomuchtodo wrote: post #19
paulb81 wrote: post #14

Earlier quoted context omitted.

I worked on this checklist and your feedback is very appreciated. You're right on all your points from a pure security point of view. We should be doing security as soon as possible. Unfortunately, the reality of building a startup is about finding product-market-fit. Entrepreneurs are not incentivized to do security early on. The fear strategy our industry is using for the last XX years has failed. As security profe…

> We can't expect developers to spend days implementing security best practices before even having a business. We absolutely can. Otherwise, expect regulation to do it (see: GDPR).

Or see TCSEC that was how the market produced the first, security-focused systems. They were only ones to pass pentesting at the time with designs and implementations still stronger than most software today. Although it had issues, its core lifecycle requirements mostly work and are still used for high-assurance security implementations. Alternatively, the DO-178B standard (now DO-178C) that got more vendors writing well-documented, well-reviewed code that they run through all kinds of static analyzers and testing tools to avoid costly re-certifications. Two examples of regulations that worked so well that they raised the status quo for both security and safety.

People mostly mention bad or questionable regulations when the topic comes up. I figure the good ones deserve mention, too, esp given they worked better than the market. That's probably due to the absence in market of both liability for software failures and most customers' ability to evaluate security claims.

TCSEC Overview https://en.wikipedia.org/wiki/Trusted_Computer_System_Evalua...

Bell Looking Back on TCSEC/TPEP http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...

DO-178B Overview https://en.wikipedia.org/wiki/DO-178B

Post reply on HN