The stupid share links blocks the left of content. Crap web layout.
Saas CTO Security Checklist
51–60 of 61 posts
Re: Saas CTO Security Checklist
#52Earlier quoted context omitted.
What do you do when the response to a bug bounty is "yeah, we already knew about that, and we're not planning to fix it soon because the consequences aren't high"? In my experience that's a pretty common scenario for early to medium stage startups.
It's not just a common scenario for early to medium stage startups. It's also a common scenario for every other business with a bug bounty program. Sometimes, the consequences aren't high. "Your CORS is configured to allow access from another domain, also owned by you." "You can give yourself a redirect to any site by intercepting and modifying your own Host header." "Your static blog on a separate domain from your a…
What I'm thinking of are things like "a paying customer can DoS you with a carefully constructed malicious input". That usually won't be practical issue if you're small enough to know all your customers - but it has the potential to be very problematic if you incentivize people to find it.
Re: Saas CTO Security Checklist
#53It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…
> * Security testing integrated into CI/CD pipeline
> * Automated routine network monitoring
Do you have specific recommendations on these 2 things?
Re: Saas CTO Security Checklist
#54Earlier quoted context omitted.
It's not just a common scenario for early to medium stage startups. It's also a common scenario for every other business with a bug bounty program. Sometimes, the consequences aren't high. "Your CORS is configured to allow access from another domain, also owned by you." "You can give yourself a redirect to any site by intercepting and modifying your own Host header." "Your static blog on a separate domain from your a…
What I'm thinking of are things like "a paying customer can DoS you with a carefully constructed malicious input". That usually won't be practical issue if you're small enough to know all your customers - but it has the potential to be very problematic if you incentivize people to find it.
This is usually addressed in your program policy. For example, look at https://hackerone.com/twitter :
> Accessing private information of other users, performing actions that may negatively affect Twitter users (e.g., spam, denial of service), or sending reports from automated tools without verifying them will immediately disqualify the report
Re: Saas CTO Security Checklist
#55Earlier quoted context omitted.
> We can't expect developers to spend days implementing security best practices before even having a business. We absolutely can. Otherwise, expect regulation to do it (see: GDPR).
OT-fun: You have 27007 karma points. ISO/IEC 27007 is one standard for "information security management systems auditing".
I’ve wasted so much time on HN, but have enjoyed it very much. Thanks for pointing that out :)
Re: Saas CTO Security Checklist
#56Earlier quoted context omitted.
I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…
Was this list also you? https://gdprchecklist.io/ The html is almost identical - is there a checklist-templating service that you used to build this?
It's inspired by this checklist.
You can get two code implementations here: https://github.com/sqreen/CTOSecurityChecklist https://github.com/sqreen/DevOpsSecurityChecklist
Re: Saas CTO Security Checklist
#57It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…
The list is mixing different subject matters. The security of all the information in your company should be handled by an information security management system, which is normally under the supervision of a CSO or CISO. The ISM gets established by defining (e. g. through policies) roles, processes and requirements for many problems occurring related to information security. The security of your infrastructure should…
Thanks for your input.
Unfortunately, startups don't have this kind of resources (CIO/CISO etc.). What we see is that security is often handled by CTOs in Seed/SeriesA startups.
Re: Saas CTO Security Checklist
#58Feedback: The section on password policy recommends requiring special characters and mixed case, then as a reference links Troy Hunt's article specifically recommending against that. To be fair, I zeroed in on this because a mega corp did the same thing this morning.
Thank you. You're right. We will change that
Re: Saas CTO Security Checklist
#59It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…
I would like to see each particular item tagged not as "Seed", "Series A", "Post Series A" but with more tangible events or metrics that would trigger needing to take those things seriously. For instance: --- "Follow an onboarding / offboarding checklist" Do this when... - you have ten or more employees, - you have at least ten thousand user accounts, OR - you have at least ten thousand dollars MRR --- "Protect your…
This is really great input! Thank you.
We will definitely take this into consideration for the next iteration.
Re: Saas CTO Security Checklist
#60Earlier quoted context omitted.
Was this list also you? https://gdprchecklist.io/ The html is almost identical - is there a checklist-templating service that you used to build this?
> The project is inspired by The SaaS CTO Security Checklist created by Sqreen.io
Ah, thanks! I didn't spot that on my first read through.