SaaS CTO Security Checklist

Post by technion » Thu, May 30, 2019, 9:55 PM UTC

orev wrote: post #28

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all o…

Post by jdreyfuss » Thu, May 30, 2019, 9:56 PM UTC

andrewstuart wrote: post #15

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…

Post by [deleted] » Thu, May 30, 2019, 9:59 PM UTC

jdreyfuss wrote: post #33

andrewstuart wrote: post #15

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…

Checklist author here. Glad you liked the idea! Figuring out a clean shorthand way to group these best practices was something we definitely thought about. The idea behind using funding rounds was to find something that can work as an easily digestible placeholder for company maturity and capabilities for most SaaS startups. Something closer to “just starting out,” “product-market fit,” and “starting to scale” rather…

Post by [deleted] » Thu, May 30, 2019, 10:02 PM UTC

montecarl wrote: post #30

cardine wrote: post #24

Earlier quoted context omitted.

Even if you knew the pattern, four random lowercase dictionary words (assuming a dictionary size of 50,000 words) would take longer to crack than a randomly generated 10 digit password with letters, numbers, and special characters. 50,000^4 > (26+26+10+10)^10

Its not quite fair to assume that people are choosing randomly from 50k words. Here is what those passwords look like. I excluded proper nouns and possessives. If you want to try, this command works on Ubuntu: echo $(cat /usr/share/dict/american-english | grep -v \' | egrep -v '[A-Z].*' | shuf -n 4 | tr '\n' ' ') trawled scratch protract sagings perpetuates barium entreated credits integrals virago chronicled weather…

Post by j88439h84 » Thu, May 30, 2019, 10:02 PM UTC

montecarl wrote: post #30

cardine wrote: post #24

Earlier quoted context omitted.

Even if you knew the pattern, four random lowercase dictionary words (assuming a dictionary size of 50,000 words) would take longer to crack than a randomly generated 10 digit password with letters, numbers, and special characters. 50,000^4 > (26+26+10+10)^10

Its not quite fair to assume that people are choosing randomly from 50k words. Here is what those passwords look like. I excluded proper nouns and possessives. If you want to try, this command works on Ubuntu: echo $(cat /usr/share/dict/american-english | grep -v \' | egrep -v '[A-Z].*' | shuf -n 4 | tr '\n' ' ') trawled scratch protract sagings perpetuates barium entreated credits integrals virago chronicled weather…