SaaS CTO Security Checklist • Hacker News Board

Re: SaaS CTO Security Checklist

#51

Post by ses1984 » Thu, May 30, 2019, 10:23 PM UTC

orev wrote: post #28

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all o…

It depends on your definitions of easy to remember, hard to guess. 6 dictionary words with one random character is sufficiently complex to thwart planetary scale brute force attacks. It's much easier to remember than 20 random ascii characters.

Re: SaaS CTO Security Checklist

#52

Post by jdreyfuss » Thu, May 30, 2019, 10:24 PM UTC

andrewstuart wrote: post #43

jdreyfuss wrote: post #33

Earlier quoted context omitted.

Checklist author here. Glad you liked the idea! Figuring out a clean shorthand way to group these best practices was something we definitely thought about. The idea behind using funding rounds was to find something that can work as an easily digestible placeholder for company maturity and capabilities for most SaaS startups. Something closer to “just starting out,” “product-market fit,” and “starting to scale” rather…

Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist". Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item. Then give each checklist item and owner and assign action items, status and followup discussion. The outcome of that is something the CTO would be interested in b…

Cool idea! I like the self-assessment angle.

We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.

Re: SaaS CTO Security Checklist

#53

Post by dllthomas » Thu, May 30, 2019, 10:26 PM UTC

jupp0r wrote: post #25

ddxxdd wrote: post #22

Earlier quoted context omitted.

What does NIST have to say about passwords like CorrectHorseBatteryStaple [0] that can be easily cracked by brute-forcing concatenations of dictionary words? [0] https://xkcd.com/936/

Quoting: When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to: - Passwords obtained from previous breach corpuses. - Dictionary words. - Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’). - Context…

If I read that correctly, it's about comparing the entire password, not portions thereof, so it's not really about "multiple English word" passwords (except that I assume "passwords obtained from previous breach corpuses" is likely to contain some specific examples of the breed, almost certainly including "correct horse battery staple").

Re: SaaS CTO Security Checklist

#54

Post by PopeDotNinja » Thu, May 30, 2019, 10:30 PM UTC

ZebZ wrote: post #23

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Easy to remember high-entropy pass phrases still makes the most sense to me, with maybe a number or symbol thrown in somewhere for added extra oomph. correct horse 19 battery staple https://xkcd.com/936/

Just don't use that as the key to generate your BitCoin address. I saw a funny video, can't remember where, where a guy does that to prove a point. He sends a small amount of BitCoin to the wallet address, and someone steals it within seconds.

Re: SaaS CTO Security Checklist

#55

Post by andrewstuart » Thu, May 30, 2019, 10:33 PM UTC

jdreyfuss wrote: post #52

andrewstuart wrote: post #43

Earlier quoted context omitted.

Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist". Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item. Then give each checklist item and owner and assign action items, status and followup discussion. The outcome of that is something the CTO would be interested in b…

Cool idea! I like the self-assessment angle. We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.

The "SAAS security dashboard". Grab that domain!

Features:

- Including an overall alert status red/yellow/green.

- Critical issues rise to the top somehow for the team's attention.

- Mechanisms and best practices for reporting security issues.

- A knowledge base linking to relevant articles on each topic.

- A button must be pressed to say that backups have been tested, failing to do so raises alert level.

- Team members jointly contribute ratings out of 10 for the companies security practice in each checklist item

- Team discussions/actions/priorities.

- Register your companies tech stack with the service and it sweeps the net for security reports about stuff that you use.

- Integrate ansible to gather information about the versions of the software you are using and issue dashboard alerts when stuff in your software stack is vulnerable to attack.

- $5,000/month

- database lives on client site

etc etc

Don't know why I give these ideas away for free. Maybe I'll get onto building it!

Re: SaaS CTO Security Checklist

#56

Post by tompic823 » Thu, May 30, 2019, 10:39 PM UTC

This list seems incredible helpful. As a security-conscientious CTO, one of the challenges I faced was determining how much we should be doing now (during YC and while raising our seed round) versus pushing down the line. For example, we obviously should be monitoring outdated and insecure dependencies from the outset, but when is the right time to switch our servers and external tools to centralized account management, or to pay for an external pen test.

Now, I would probably move the external pen test up to seed if the company is well-funded (e.g. post demo day) and holding PHI. But that’s personal preference and my security paranoia talking. Overall I think this list really gets it right.

I also liked seeing a recommendation against sharing your WiFi network in the seed stage. Network segmentation to separate your computers and IoT devices, printers, etc. should probably appear somewhere in series A/B.

Re: SaaS CTO Security Checklist

#57

Post by snarfy » Thu, May 30, 2019, 10:42 PM UTC

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

At least 8 characters, upper and lower, numbers and symbols... that advice is from the 70s [1]

[1] - https://security.stackexchange.com/questions/33470/what-tech...

Re: SaaS CTO Security Checklist

#58

Post by txcwpalpha » Thu, May 30, 2019, 10:51 PM UTC

dyu wrote: post #46

txcwpalpha wrote: post #36

Earlier quoted context omitted.

It would be very interesting to see the results of a study asking people to come up with a list of random words. I really doubt that the actual dictionary size would be anywhere near 50k, and probably would have a high frequency of common words like 'apple', 'house', 'food' etc, making them easier to crack, and almost no frequency of less common words.

the assumption is you do not come up with your own words, and pick words at random from the whole dictionary.

I'm not sure I agree with that assumption, as the entire purpose of a passphrase of words rather than a password of random characters is that the passphrase should be easier to remember. If you're randomly picking words like 'gargarize-youster-noctivagant-axilla', it's not exactly accomplishing that purpose very well. It's also a huge PITA to type in, which based on my experience in the IAM space, is an immediate dealbreaker.

Re: SaaS CTO Security Checklist

#59

Post by czbond » Thu, May 30, 2019, 10:58 PM UTC

andrewstuart wrote: post #55

jdreyfuss wrote: post #52

Earlier quoted context omitted.

Cool idea! I like the self-assessment angle. We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.

The "SAAS security dashboard". Grab that domain! Features: - Including an overall alert status red/yellow/green. - Critical issues rise to the top somehow for the team's attention. - Mechanisms and best practices for reporting security issues. - A knowledge base linking to relevant articles on each topic. - A button must be pressed to say that backups have been tested, failing to do so raises alert level. - Team memb…

I did - early beta. Based on my experience as CISO for SaaS a well as running security engineer team at a Fortune 5 company, performing Tier 1 PCI DSS, NESA, scans, etc https://joinsecurekit.com/

Re: SaaS CTO Security Checklist

#60

Post by jupp0r » Thu, May 30, 2019, 10:58 PM UTC

orev wrote: post #28

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all o…

> and as a result are actually causing many security problems.

That's completely contradictory to what the NIST guidelines state:

> The most notable form of these is composition rules, which require the user to choose passwords constructed using a mix of character types, such as at least one digit, uppercase letter, and symbol. However, analyses of breached password databases reveal that the benefit of such rules is not nearly as significant as initially thought [Policies], although the impact on usability and memorability is severe.