Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 31 posts

Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#1

Post by codinmath »

Hi,

I used to be just a regular software engineer, now I'm "responsible", of the cybersecurity of a 30 people startup/scale-up, on top of actually building/maintaining features.

We can't afford a full time security expert for now, we're going to raise more money soon, but for now I'm +/- the only guy with cybersecurity experience.

We have huge clients, a big leak/hack would be a death sentence for the company IMO, and disastrous for a lot of people.

I found a few weaknesses on a few websites and on our own(it was just luck really), but I'm no expert, mostly self taught since I was a kid, I'm no junior but I'm far from an actual senior dev, most of the team is not really experienced(just smart bootcamp grads).

We're going to have a red team/agency audit us soon(we're going to get ripped to pieces, 100%)

How do I go ASAP from the scared relatively inexperienced guy I am who feels like the weight of the world is on his shoulders, to a guy that can actually handle this?

What course, book, MOOC website, SaaS, tool would you advise me to go through to handle this?

Thanks a lot

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#2

Post by ericalexander0 »

Having built security programs at multiple companies, I can tell you it's not something as easy as one person cramming content for a day and then implementing with ease.

It's also unclear what outcome the business is looking for. If I had to guess, a big contract requires "security" and management wants to check that box the cheapest way possible.

If it's about first steps to improving security posture, and assuming you have a SAAS offering - then the first thing I'd do is start a bug bounty with hackerone or bugcrowd. It's the quickest way to both establish a feedback loop on security state, while also introducing a forcing function to prioritize fixing defects.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#3

Post by telesilla »

Look for VCSO (virtual security officer), an auditor, or start your SOC2 process. You'll get guidance from day 1 where the immediate holes are.

Also bear in mind that the audit that's coming is designed to help you, not break or hack you. It's a positive step to being more secure.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#4

Post by spsesk117 »

I wouldn't call myself a security person, but I do have a fair amount of experience implementing things downstream of the security organization, and sometimes outside of that context.

I think a reasonable place to start is something like the NIST Cybersecurity standard. In my limited experience, the NIST Cybersecurity standard deals more with _risk_ than it does with discrete technical guidance, but from their fairly comprehensive risk framework you can start to frame the technical problems in your environment through this risk lens.

Additionally, I'll recommend something that's maybe wrong (security folks jump in as needed), but I typically try to work outwards in when securing an environment. In the case you've got a web app or something, reduce the attack surface of the system externally as much as possible (closing ports/IP filtering on management ports/etc) and then work your way inwards.

Put another way, try to focus on bang for you buck until you have a dedicated a team. An obscure XSS that requires a strong working knowledge of the system is _very bad_, but if you also have port 22/SSH open to the world with a 5 char password, I'd figure that one out first. That's obviously an extreme example, but I think you get the point.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#5

Post by aliswe »

1. Start thinking in terms of accepted risk. What is accepted risk? It's risk that you, evryone at the company, and its stakeholders are willing to accept failure because of.

For example, going out to buy milk at 3am inabrough neighborhood might not be accepted risk - the risk vs value is off.

To buy diapers in a 3am emergency? Yup.

To drive a car on the motorway is hella dangerous. Super risky when you think about it. But you can't not do it. (presumably/ So what do you do? You check your brakes, indicators, steering, etc bfore taking off. Get it to periodical checkups.

Then if it fails, you did your part, you did what you could. It's accepted risk.

It's at the point when you go "well, if I'm not gonna do that then I might as well stay in bed all day". You could get hit by a meteor going out your door you know.

If you declare something an accepted risk, accept no blame for it failing. it was accepted risk. not your falt that it happened, but it was you who decided that its accepted risk. It was your decision (but inform everyone). If you dont want to stand for the decision, defer it, or maybe you're in the wrong spot.

2. Then there is the concept of unknown unknowns. Talk to everybody in the company, make sure that noone sits on a domain or problem area you are totally unaware of. Survey/canvas the landscape, and report back to your superiors. Then drill down wherever necessary

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#6

Post by 0xfaded »

First document every "near-miss" or risk you find.

Go make the exact same argument to your CEO, $XX million start-up flatlines with a single slip up.

Make it as easy as possible for your CEO to go to the company board, repeat the argument, and make an ask to shareholders for a loan to hire a security expert. Your self taught experience will help in finding the right person.

Befriend the new security person and learn everything they have to share.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#7

Post by vivegi »

If you can get a budget for a security consultant/auditor to help put the policies and frameworks together, including conducting a baseline audit and identifying gaps, that would be a start.

While IT aspects are a big part of the security (patches, vuln assessments, access control, environment separation etc.,) there are quite a few policy, documentation, review and controls and people aspects etc., that are important in any infosec framework.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#8

Post by mtmail »

vivegi wrote: post #7

If you can get a budget for a security consultant/auditor to help put the policies and frameworks together, including conducting a baseline audit and identifying gaps, that would be a start. While IT aspects are a big part of the security (patches, vuln assessments, access control, environment separation etc.,) there are quite a few policy, documentation, review and controls and people aspects etc., that are importan…

And if you can't get the budget have that decision in writing.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#9

Post by otoburb »

Congratulations!

>>[...] now I'm "responsible", of the cybersecurity of a 30 people startup/scale-up, on top of actually building/maintaining features.

>>[...] we're going to raise more money soon, but for now I'm +/- the only guy with cybersecurity experience.

>>We have huge clients, a big leak/hack would be [...] disastrous for a lot of people.

You've just outlined the business justification for you to be the defacto interim full-time CSO and drop/transition feature development duties "until the next round is raised, Soon (TM)". Have this (potentially difficult) conversation with your CEO today to help set up both yourself and the company for success, not failure.

Re: Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?

#10

Post by ttymck »

otoburb wrote: post #9

Congratulations! >> [...] now I'm "responsible", of the cybersecurity of a 30 people startup/scale-up, on top of actually building/maintaining features. >> [...] we're going to raise more money soon, but for now I'm +/- the only guy with cybersecurity experience. >> We have huge clients, a big leak/hack would be [...] disastrous for a lot of people. You've just outlined the business justification for you to be the de…

Doesn't "CSO" come with potential for personal liability in worst-case scenarios?

It's not clear if OP volunteered/applied for this security role, or it was thrust upon them. If the company isn't wise enough to know they need a CSO, I have to think it's quite risky to jump headfirst into that pool.

I also think this advice (the comment I'm replying to) is rather misguided. OP was asking "how do I get better at security". Instructing them to say "I'm the new CSO" seems like a leap. If they knew what being CSO meant, and how to do it, they wouldn't be asking for advice here. But maybe I'm overestimating the "riskiness" of assuming responsibility for the security of BigCo data.

Post reply on HN