11–20 of 114 posts
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
Would love to see a plain, non-javascript version of this content.
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
(message for Tyler: we're still waiting on those cookies)
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
I'd be more inclined to do a "drinks" option.
But aimed perhaps at everyone, not just the CTO.
In fact the CTO probably needs one thing on their checklist.
Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly".
And if the company has the financial resources:
Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist quarterly".
I don't see any value in relating anything to the financial stage of the company because it's irrelevant.
Security also needs a time and priority aspect to it. For example if your company hasn't done anything on the checklist yet then what should come first, what is most important? Also it would be good to know what are the biggest typical weaknesses - a security chedclist can have so much stuff on it that it becomes hard to know where to focus.
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?
Imagine your co-worker on the next day with two or three dozens of Krispy Kreme products.
> (links to https://www.digicert.com/blog/creating-password-policy-best-...) where they give the usual (at least 2 special characters, but not " or \) advice
This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1].
[1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...
I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…
Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought.
> I don't see any value in relating anything to the financial stage of the company because it's irrelevant.
It is extremely relevant, for at least two reasons. The first one is that the company’s financial resources dictate what you can or cannot do (e.g. hire a dedicated security resource, pay for pen testing). The second is that some recommendations just don’t make sense before a certain size (e.g. there’s no sense in setting up an AD and GPOs when there’s just 3 of you in the company).
I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…
> Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought…