SaaS CTO Security Checklist • Hacker News Board

Re: SaaS CTO Security Checklist

#71

Post by tptacek » Fri, May 31, 2019, 12:10 AM UTC

orev wrote: post #28

jupp0r wrote: post #18

> Enforce a password policy > (links to https://www.digicert.com/blog/creating-password-policy-best-... ) where they give the usual (at least 2 special characters, but not " or \) advice This is counterproductive and is actually discouraged by the latest NIST guidelines, that prefer passwords that are easy to remember, but still hard to guess [1]. [1] https://auth0.com/blog/dont-pass-on-the-new-nist-password-gu...

Starting to feel like this is one of those things that people just blindly parrot all over the Internet without understanding the full context of the NIST guidelines, and as a result are actually causing many security problems. You can’t take one recommendation that you like out of a whole body of work and start running around telling everyone to do this one thing. If you’re going to follow NIST, you need to do all o…

This is simply not true. You can read SP800-63B Appendix A to see the rationale NIST provides for not enforcing password complexity; it has nothing to do with MFA, and NIST believes the old rules to be intrinsically bad.

Re: SaaS CTO Security Checklist

#72

Post by tptacek » Fri, May 31, 2019, 12:14 AM UTC

tompic823 wrote: post #56

This list seems incredible helpful. As a security-conscientious CTO, one of the challenges I faced was determining how much we should be doing now (during YC and while raising our seed round) versus pushing down the line. For example, we obviously should be monitoring outdated and insecure dependencies from the outset, but when is the right time to switch our servers and external tools to centralized account manageme…

The best indication that you need an external penetration test is that you have client prospects demanding to see the output of those tests. A less important indication would be that you (1) have product/market fit, (2) have implemented your core product, (3) can predict what development on that product will look like for the next 12 months, and (4) have revenue sufficient to eat the $20-30k cost of a penetration test.

I would not generally recommend that seed-stage companies contract out penetration tests simply because they've raised enough money to do so. You should be on a relatively stable, predictable path with regard to product engineering before you start asking contract pentesters to beat you up.

I feel like this is a pretty good illustration of how not useful lists like these are. It's simplified down to this "seed", "series A", "series B" thing in order to suit the format and make it punchy; the real, serious advice isn't as slick, and doesn't showcase their product, so it's nowhere to be found.

Re: SaaS CTO Security Checklist

#73

Post by tptacek » Fri, May 31, 2019, 12:16 AM UTC

jammygit wrote: post #29

laurentl wrote: post #19

Earlier quoted context omitted.

> Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought…

How lucrative is security work? It’s a direction I’ve been considering moving towards but the salary info I’ve seen is not great. Am I looking up the wrong terms/titles?

As an employee, application and infrastructure security work pays somewhat better than normal product engineering work (there are good jobs and bad jobs, of course).

There are lots of security jobs that don't pay especially well and are career dead-ends --- enteprise IT security isn't a good place to end up, nor is sales engineering ("security engineer") for security product companies, nor is malware analysis.

My feeling is that software/application security consulting is a reasonable route to go, if you want to work for a consultancy, but I'd be wary of any other kind of security consulting.

Re: SaaS CTO Security Checklist

#74

Post by tptacek » Fri, May 31, 2019, 12:20 AM UTC

andrewstuart wrote: post #15

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…

Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.

Re: SaaS CTO Security Checklist

#75

Post by dgrove » Fri, May 31, 2019, 12:30 AM UTC

okusername wrote: post #16

Eldt wrote: post #7

"At Sqreen, for example, if someone catches another person’s laptop unlocked while they’re AFK, they can type “Cookies!” in that person’s Slack. That person will then have to bring in cookies for the office!" This sounds like a fun idea, but has anyone ever refused to bring in cookies?

I don't think you can enforce this, would be horrible for morale and probably illegal. I like to have similar "punishments" in my teams, people generally have fun with it. (And the rules apply to me too of course) But if someone doesn't want to, they can just ignore it. (Usually 1 in 10-20)

Multiple teams I've been on at multiple companies have done this process, but with donuts and other foods. A little bit of public shame goes a long way.

Re: SaaS CTO Security Checklist

#76

Post by dgrove » Fri, May 31, 2019, 12:41 AM UTC

Lots of talk about passwords, but fewer about password managers. The password managers listed in this do not protect against backdoors. Lastpass, for example keeps all your passwords in plain text once you've unlocked it. Passwords stored in Apples Keychain can be synced across devices and a remote attacker can do something like a sim port, gain access to your iCloud account and then sync to their computer leaving you vulnerable.

Password managers should be bound to hardware tokens and each password should be individually encrypted, as well and individually decrypted that also force physical tap.

Password Store is a perfect example of this. Physical password managers are also on the rise, see: Ledger and Mooltipass

Re: SaaS CTO Security Checklist

#77

Post by tptacek » Fri, May 31, 2019, 12:51 AM UTC

dgrove wrote: post #76

Lots of talk about passwords, but fewer about password managers. The password managers listed in this do not protect against backdoors. Lastpass, for example keeps all your passwords in plain text once you've unlocked it. Passwords stored in Apples Keychain can be synced across devices and a remote attacker can do something like a sim port, gain access to your iCloud account and then sync to their computer leaving yo…

I don't believe it is the case that you can SIM-swap your way to someone's iCloud Keychain. Despite the "iCloud" in the name, it's not simply a file stored on iCloud; it's bound by keypairs to both devices and your iCloud password.

Re: SaaS CTO Security Checklist

#78

Post by rorykoehler » Fri, May 31, 2019, 1:01 AM UTC

andrewstuart wrote: post #15

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…

>if your company hasn't done anything on the checklist yet then what should come first, what is most important?

Security practitioners like to use the risk analysis matrix for this exact reason. One axis is likelihood of problem occurring (ranging from unlikely to almost certain) and the other is impact problem occurring will have on the business (ranging from embarrassing to bankrupting the business). As you can immediately see this is a very good tool to focus the efforts on the right remdiations.

Re: SaaS CTO Security Checklist

#79

Post by rorykoehler » Fri, May 31, 2019, 1:03 AM UTC

tptacek wrote: post #74

andrewstuart wrote: post #15

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist qua…

Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.

We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.

Re: SaaS CTO Security Checklist

#80

Post by ses1984 » Fri, May 31, 2019, 1:04 AM UTC

noir_lord wrote: post #63

ses1984 wrote: post #51

Earlier quoted context omitted.

It depends on your definitions of easy to remember, hard to guess. 6 dictionary words with one random character is sufficiently complex to thwart planetary scale brute force attacks. It's much easier to remember than 20 random ascii characters.

I use the first three letters of each word in book titles/song lyrics and a number that means something to me like 186282 (speed of light in a vacuum in miles per second) for master passwords everything else is stored in Keepassxc. aphiofsofdes68537513 is good enough and defeats a dictionary attack. It requires discipline but I’m responsible for people’s PII at work and I treat that seriously. For my personal stuff I…

I did something similar but you really should get some randomness in there. If an attacker is brute forcing solutions, it's conceivable, even likely, that attackers are going to smash together datasets like song lyrics or anything that comes up high in a google search to prioritize the search space. You could search millions of permutations of song lyrics for the 50% most popular songs on Spotify. You could do the same with text previews for books on Amazon. It probably wouldn't take that long for a targeted attacker.

If 2fa is involved it's a different story, but if you're talking about something liiiike the pass key of a private key that you can't guarantee is secret? Or if it's the private key used to do things like sign certificates? Please add randomness.