Saas CTO Security Checklist • Hacker News Board

Re: Saas CTO Security Checklist

#31

Post by amarkov » Mon, Mar 19, 2018, 4:39 AM UTC

dsacco wrote: post #23

jbaviat wrote: post #10

Earlier quoted context omitted.

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

> Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money Ehhhhhhh...I disagree. 1. Most of my clients tend closer to seed stage than to well-funded. 2. You don’t need security expertise or money to run a good bug bounty program. You can start one immediately. There are enough high quality resources available for free on the…

What do you do when the response to a bug bounty is "yeah, we already knew about that, and we're not planning to fix it soon because the consequences aren't high"? In my experience that's a pretty common scenario for early to medium stage startups.

Re: Saas CTO Security Checklist

#32

Post by [deleted] » Mon, Mar 19, 2018, 5:05 AM UTC

irundebian wrote: post #20

toomuchtodo wrote: post #19

Earlier quoted context omitted.

> We can't expect developers to spend days implementing security best practices before even having a business. We absolutely can. Otherwise, expect regulation to do it (see: GDPR).

OT-fun: You have 27007 karma points. ISO/IEC 27007 is one standard for "information security management systems auditing".

[deleted]

Re: Saas CTO Security Checklist

#33

Post by [deleted] » Mon, Mar 19, 2018, 5:20 AM UTC

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

[deleted]

Re: Saas CTO Security Checklist

#34

Post by twelve40 » Mon, Mar 19, 2018, 5:26 AM UTC

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

> With the exception of bug bounties, which you might not bother ever doing at all

Why not?

Re: Saas CTO Security Checklist

#35

Post by maruhan2 » Mon, Mar 19, 2018, 8:47 AM UTC

"It will protect against both malicious activities and accidents (e.g. an employee’s child accidentally wiping a mailbox)."

Can someone help me understand how a child accidentally wiping a mailbox is related to encryption? Isn't this just a matter of putting a password on your computer and not related to encryption?

Re: Saas CTO Security Checklist

#36

Post by ozim » Mon, Mar 19, 2018, 8:47 AM UTC

beager wrote: post #27

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I would like to see each particular item tagged not as "Seed", "Series A", "Post Series A" but with more tangible events or metrics that would trigger needing to take those things seriously. For instance: --- "Follow an onboarding / offboarding checklist" Do this when... - you have ten or more employees, - you have at least ten thousand user accounts, OR - you have at least ten thousand dollars MRR --- "Protect your…

For SSL I think there is industry consensus to push for HTTPS everywhere. There is no argument to skip it. With free lets encrypt certificates. It is not like you will spend a week implementing it, without prior experience decent developer should have it up and running in half of day.

Re: Saas CTO Security Checklist

#37

Post by ozim » Mon, Mar 19, 2018, 8:52 AM UTC

jbaviat wrote: post #10

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

I have only one thing to nag about. Password complexity rules. Please only do length check and promote checking against dictionary passwords to be rejected. For password security this was last year hot document: https://www.nist.gov/itl/tig/projects/special-publication-80...

Re: Saas CTO Security Checklist

#38

Post by dkns » Mon, Mar 19, 2018, 9:05 AM UTC

Don't just make backups and then backups. Test regularly if you can restore your system from said backups. The worst feeling in the world is having backups and then learning that you can't restore from them in case of emergency.

Re: Saas CTO Security Checklist

#39

Post by lcpriest » Mon, Mar 19, 2018, 9:25 AM UTC

jbaviat wrote: post #10

tptacek wrote: post #7

It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us). What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong. Here's their "Series A" list: * No shared accounts * Centralized account management * Centralized logs * Server list * DDo…

I’m the CTO at Sqreen and I do love Matasano (cryptopals... awesome crypto challenge https://cryptopals.com/ ). Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money :) Thanks for the missing things we will update! By the way this is open source, feel free to contribute: https://github.com/sqreen/CTOSecurityChecklist (not…

Was this list also you? https://gdprchecklist.io/

The html is almost identical - is there a checklist-templating service that you used to build this?

Re: Saas CTO Security Checklist

#40

Post by thaumasiotes » Mon, Mar 19, 2018, 9:38 AM UTC

amarkov wrote: post #31

dsacco wrote: post #23

Earlier quoted context omitted.

> Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money Ehhhhhhh...I disagree. 1. Most of my clients tend closer to seed stage than to well-funded. 2. You don’t need security expertise or money to run a good bug bounty program. You can start one immediately. There are enough high quality resources available for free on the…

What do you do when the response to a bug bounty is "yeah, we already knew about that, and we're not planning to fix it soon because the consequences aren't high"? In my experience that's a pretty common scenario for early to medium stage startups.

It's not just a common scenario for early to medium stage startups. It's also a common scenario for every other business with a bug bounty program.

Sometimes, the consequences aren't high.

"Your CORS is configured to allow access from another domain, also owned by you."

"You can give yourself a redirect to any site by intercepting and modifying your own Host header."

"Your static blog on a separate domain from your actual site is accessible over unencrypted HTTP."

"If I zoom in on your web page, the text becomes blurry."

If your question was from the other end, "what do you do as the company when you get a report like this?", I say something like "We don't believe that this warrants fixing at this time. Thanks for your interest in our program, and we hope you continue reporting to us in the future!"