SaaS CTO Security Checklist • Hacker News Board

Re: SaaS CTO Security Checklist

#111

Post by yaleman » Sat, Jun 01, 2019, 4:18 AM UTC

DKnoll wrote: post #93

someonehere wrote: post #87

Earlier quoted context omitted.

Yeah but when you partner with companies, they sometimes force your company to adhere to those ancient guidelines. I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.

If you require PCI DSS compliance it won't fly either. https://pcipolicyportal.com/blog/pci-compliance-password-req...

If you require PCI DSS I hope you're not just blindly following some random post on hackernews for your policy ;)

Re: SaaS CTO Security Checklist

#112

Post by yaleman » Sat, Jun 01, 2019, 4:24 AM UTC

tptacek wrote: post #68

Discussed previously: https://news.ycombinator.com/item?id=16615593 In the year this has percolated with me, I've grown to actively dislike it. I have three major problems with it: 1. This cutesey "seed, A, B" triage scheme is misleading. In reality, you can break everything down into just two categories: "do it before product/market fit" and "do it after product/market fit" (or "now" and "later", or whatever you'd l…

2FA on SaaS applications is free and easy, while centralising authentication is much harder - you need to manage an authentication platform instead of just using the application's own authentication.

Taken by itself the suggestion is odd, but in concert with the next entry "use password management software" it makes for a low-cost, zero management, higher security stance than not suggesting 2FA by itself. Noone should ever ignore the option to turn on 2FA.

Re: SaaS CTO Security Checklist

#113

Post by DKnoll » Sat, Jun 01, 2019, 4:35 AM UTC

yaleman wrote: post #111

DKnoll wrote: post #93

Earlier quoted context omitted.

If you require PCI DSS compliance it won't fly either. https://pcipolicyportal.com/blog/pci-compliance-password-req...

If you require PCI DSS I hope you're not just blindly following some random post on hackernews for your policy ;)

I'm not, that's why I know PCI DSS requirements off-hand.

Re: SaaS CTO Security Checklist

#114

Post by downtown_ » Sun, Jun 02, 2019, 5:17 PM UTC

DKnoll wrote: post #93

someonehere wrote: post #87

Earlier quoted context omitted.

Yeah but when you partner with companies, they sometimes force your company to adhere to those ancient guidelines. I’ve worked for companies where they ask for the out of date NIST stuff you mention and it’s either you follow what they ask or you lose out on a deal to fund your company.

If you require PCI DSS compliance it won't fly either. https://pcipolicyportal.com/blog/pci-compliance-password-req...

No. You can use NIST guidance and are not required to change your password every 90 days