13 ms·

Latacora: Security Programs For Startups

98 points by MattRogish 10y ago

tptacek 10y ago
I guess if people are interested and have questions I can try to take a stab at them, but really you'll be having a conversation with three people who have only a faint idea of exactly how this is going to work, since we're still in learning mode. :) The next thing I'm actually shipping is the first batch of post-Starfighter challenges. The next thing I'm actually writing is "what happened with Starfighter".
- splawn 10y ago
  Is it pronounced lata-cora or la-taco-ra?
  - tptacek 10y ago
    Dunno. What sounds better? La-TACO-ra hadn't even occurred to me.
    - celticninja 10y ago
      I read it as later-kora
    - splawn 10y ago
      lata-cora rolls off the tongue easier, imo. (I think i am just hungry)
  - jrauch 10y ago
    I like tacos, but the latter sounds more like a food truck than a security company.
- spitfire 10y ago
  This seems quite useful. Will you help find/place the right first hire for when companies outgrow you? That's the critical final selling point for me. Great, you've taken security off my plate in a small business. But now I'm disengaged from the security side of things when it comes time to find the first full time security hire. Very cool though. Good luck!
  - tptacek 10y ago
    Yes, we will. We want to be the bridge --- for maybe, I don't know, 9-18 months? --- between "we've reached the point where we think we need a security team" and "we've been doing security long enough as a team that we know what we need for a full-time lead security person". There's a weird adolescence that happens between those two points where we see people struggling to staff effectively. We think we can get companies to a point where they've built a solid security program and run it for months before hiring for security --- and that the net result is that you're hiring that role more like how Jason Fried from Basecamp would say you should hire: when you understand the role so well that you know exactly why and how you should hire for it. We could always be wrong.
    - no_protocol 10y ago
      "Coming soon: Latacora Security Academy, graduate and we'll place you at a company with good security already in place." I would apply.
- warkdarrior 10y ago
  How is this different from a Managed Security Service Provider?
  - tptacek 10y ago
    MSSPs manage firewalls, watch IDS alerts, and run periodic Nessus scans. They're a way of outsourcing secops teams. We can do those things (we'd recommend against some of them), but the ambit of what we're doing is much broader.
- Canada 10y ago
  Are you looking for/interested in partners to help do the work?
- manyxcxi 10y ago
  This couldn't have come at a better time for us. You shall be receiving an email on Monday as we're having to negotiate the waters of SOC compliance in order to serve certain customers of ours.
- nchelluri 10y ago
  Suppose I ran a small company with a small dev and ops team of 3-4 people, running a Rails app with a MySQL database, typical setup say, Nginx front end proxy to servers running mod_passenger, a separate staging and QA environment. What services would you provide to me if I paid you what I would pay a well qualified security person? Just asking out of curiosity, I've been dabbling in web/app security for the past couple years and know it's a very broad and deep field. I know about protecting against XSS, CSRF, SQL injection, and the basics of OWASP Top 10, but not sure what you'd be doing and how you would provide me service. Would it be an ongoing contract or a one time or as-needed service? As a side note: http://lcamtuf.coredump.cx/tangled/ http://lcamtuf.coredump.cx/tangled/ makes me feel like I've never considered the possibilities of anything thoroughly.
  - tptacek 10y ago
    A decent short answer for this is that we'd work it out the same way you'd work it out in the hiring process for a Director of Security: by discussing your needs and determining what we were able, as "one entity", to do. The website gives a sort of sweeping idea of what things we're capable of tackling. I should add, though, that I think a lot, maybe even most, startups don't need this, or dedicated security of any kind.
- somberi 10y ago
  Apart from helping with better code practices may I know what other areas of expertise one can hire you for? Genuine question. Oh and all the best by the ways.
nickpsecurity 10y ago
I suggested this exact thing on Schneier's blog to keep security from being an afterthought or too expensive. Great to see a group think of and actually do the same thing. Good team for this. The prior experience will help them iterate more effectively into a model that works. Then others can copy it. Or they might even franchise it.
purpledragon 10y ago
How does this business scale without affecting quality? Why is the birth of this particular (small) security consulting firm more newsworthy (in contrast to all of the others that have popped up)?
- tptacek 10y ago
  1. It doesn't. 2. I don't know.
- jeffmcjunkin 10y ago
  1. tptacek answered this already. 2. https://news.ycombinator.com/leaders https://news.ycombinator.com/leaders (read #1)
  - tptacek 10y ago
    I mean, yes, (2) is why it's on the front page, but I too find it weird that we're talking about this.
mxuribe 10y ago
This sounds like a great idea! Kudos and best of luck!
deleted 10y ago
[deleted]
lifeisstillgood 10y ago
I am working with a small startup as their "technical advisory board" - clearly not as security minded as here, but the goal is the same, to take a brain dump from me and use it as a framework for the next couple of months of work. I like this idea, and hopefully it's self selecting. People who won't listen to good advice won't hire you in the first place !
tetrep 10y ago
Ha, I guess a management role is the natural progression from technical consulting. I love the idea of a middle ground between "we have things people would want to hack" and "we have a dedicated security team." It's great when you can hire security conscious developers, but startups generally aren't know for seeking out nor emphasizing those skills. AFAIK nobody has adopted "Move carefully and write secure code with minimal technical debt." A seasoned security team would also be able to effectively avoid snake oil security consultants (no, you really don't need to encrypt the user's password with JavaScript before transmitting it to the server), which are all the more tempting to hire as they're generally cheap (run Nessus, print and deliver report...).
- tptacek 10y ago
  Thanks. But to be clear: we very much want to keep our hands dirty. Part of the attraction of this idea is that it's an opportunity for us to build stuff.
- Normal_gaussian 10y ago
  Do you hang out in #HighAltitude or am I experiencing the Baader-Meinhof Phenomenon?
lifeisstillgood 10y ago
Preamble :a lot of agencies (Im thinking postlight) act as "hire us for three months to get the idea off the ground" - they try to take away the headache of not having actually hired a good team yet. Question: Are you part of a fracturing of this? That people could hire you for security, postlight for front end, someone else for ecommerce / payments etc. I think I am asking is the postlight model distrusted, is hiring your style of team easier to fit around a growing team. What is the gap in the market you are seeing?
- tptacek 10y ago
  I don't think so. I think you need a solid, invested engineering team for us to plug into in order to get any value out of what we're doing.
ShaneWilton 10y ago
From the HTML source:   document.addEventListener("DOMContentLoaded", function(event) { var names = ["Erin Ptacek", "Thomas Ptacek", "Jeremy Rauch"]. sort(function(x, y) { return 1 - Math.ceil(Math.random() * 100) % 3; }); for(var i = 0; i < 3; i++) { document.getElementById("n_" + i).textContent = names[i]; } }); It isn't scientific in the slightest, but I ran the function a hundred million times, and Erin seems to appear first about 60% of the time, in Google Chrome. Good luck with the company, I hope you can also beat the RNG that makes or breaks a startup :)
- tomjen3 10y ago
  It is not (just) the RNG that is broken, it is using modulo - it sorts into buckets and there is no way to evenly divide 100 items into 3 buckets.
- RKoutnik 10y ago
  Ah, I think I've figured it out (nothing to do with JS's RNG, sadly). It's simpler when you ignore Jeremy (sorry). For this case, we can assume `Math.random()` will output uniformly random numbers. `Array.prototype.sort` works as so: If the function returns > 0, the first param should be sorted to a higher index than the second. If the function returns < 0, the first param should be sorted to a lower index than the second. If the function returns exactly zero, the parameters are left as they are. So what we've got is a 1/3 of Erin 'winning', 1/3 of Thomas 'winning' and a 1/3 chance of a tie which leaves Erin ahead. So she's got a 2/3 chance of being first. Additionally (but not in any consequential fashion), generating a random number between 1 and 100 (inclusive) gives you 100 possibilities (duh). With three outcomes: 100 / 3 = 33.333333333333336 The first option has slightly more chance to be picked. If Erin wanted to be fair(er), she'd multiply by 99. Here's a Python solution showing it's not just JS: link: http://paste.ubuntu.com/23222240/ http://paste.ubuntu.com/23222240/ results: { 'Erin Ptacek': 6523, 'Thomas Ptacek': 1951, 'Jeremy Rauch': 1526 } (with apologies to ShaneWilton, I've completely rewritten this comment so the following comments are out of date)
vemv 10y ago
Might be good to mention what programming languages do you work with, as security is quite coupled with application code...
- tptacek 10y ago
  I think we'll be OK. :)
- wglb 10y ago
  A qualified pentester can work with, audit, and break code in any language. There are a few that I have not heard of anyone actively pentesting them, and they include RPG III, and the family of Bliss languages.
djcapelis 10y ago
This is great. Someone needed to do one of these, I dabbled in this market with my little one person shop because it seemed so critically underserved, but my constraints were a bit different. Some of the challenges I faced in trying to help startups: I needed to be paid in real money, which is tough for a startup. I didn't market myself at all (not even a webpage) which is just neglectful. And finally, surprisingly: frankly I found startups to have the worst legal advice and contracts. All of them went to their lawyers and came back with contracts that looked like employment agreements and frankly included worse terms than most employment agreements. I had my own agreement, but it didn't help much. I had a surprising number of deals fall through because of this. Part of it is I clearly allowed incorrect expectations, and part of it is, I think is if people haven't heard of you they just assume you'll be unrepresented and shocked when you don't just sign their standard "we put whatever we thought would be best for our client" contract and instead asked for a version for a lawyer to redline. So frustrating. And for real, most startups didn't need that much of my time, so it became not worth it. Instead I had a much better experience with a lot less pain (and frankly more interesting work) working on multibillion dollar public infrastructure contracts (train systems mostly) and focused on those instead. Go figure. You'd expect startups to do better in this area than larger companies. Thankfully Thomas is well known on the Internet, which I think will help a lot with startups. And it's a better model than what I was doing. Anyway! Thanks for doing this! It's a huge unfilled area. Someone needed to and I hope it works well!
- tptacek 10y ago
  Our one key advantage: after selling Matasano, we do not require payment in real money. :)
  - gingerlime 10y ago
    So you're actually investing in startups, but instead of your money, you invest your time/expertise? I don't know anything about Matasano, apart from seeing the name on HN frequently, but I was wondering if you already had a successful security consultancy and sold it, why set up another one? I guess this answers that question.
  - 10y ago
richerlariviere 10y ago
>Growing a business is exciting. We'd like to make it just a little less exciting for you. The second sentence sounds weird for me. Maybe I didn't understand because I don't speak English natively and I missed some kind of humor.
- anilgulecha 10y ago
  Double entendre, "exciting" here refers to the fun of a startup and to security-issues and vulnerabilities in software.
briancl 10y ago
Every strong engineering team needs someone with real security chops.. not just someone who can fix SQLi after it's been pointed out, but someone who gets security at the infrastructure level. Someone who gets the why, not just the how. Not every team has that person or that person can't devote the time to play that role. With a few good references and strong VC/Accelerator connections, this boutique consulting business should do fine. The question for me is how much pain is there on the board/founder (the key influencers/buyers of the service) compared to the cost of the services... or the risk of doing nothing.
- tptacek 10y ago
  Most startups don't need a dedicated security person and don't need a service like ours to bridge them to a full-time internal security team. So I think you're right: boards and founders are going to question whether they want something like this. On the flip side: we have the bandwidth for only a few clients (we're doing a lot of work here), so mutual selectivity is a win. :)

98 points by MattRogish 10y ago

I guess if people are interested and have questions I can try to take a stab at them, but really you'll be having a conversation with three people who have only a faint idea of exactly how this is going to work, since we're still in learning mode. :) The next thing I'm actually shipping is the first batch of post-Starfighter challenges. The next thing I'm actually writing is "what happened with Starfighter".

splawn 10y ago
Is it pronounced lata-cora or la-taco-ra?
- tptacek 10y ago
  Dunno. What sounds better? La-TACO-ra hadn't even occurred to me.
  - celticninja 10y ago
    I read it as later-kora
  - splawn 10y ago
    lata-cora rolls off the tongue easier, imo. (I think i am just hungry)
- jrauch 10y ago
  I like tacos, but the latter sounds more like a food truck than a security company.
spitfire 10y ago
This seems quite useful. Will you help find/place the right first hire for when companies outgrow you? That's the critical final selling point for me. Great, you've taken security off my plate in a small business. But now I'm disengaged from the security side of things when it comes time to find the first full time security hire. Very cool though. Good luck!
- tptacek 10y ago
  Yes, we will. We want to be the bridge --- for maybe, I don't know, 9-18 months? --- between "we've reached the point where we think we need a security team" and "we've been doing security long enough as a team that we know what we need for a full-time lead security person". There's a weird adolescence that happens between those two points where we see people struggling to staff effectively. We think we can get companies to a point where they've built a solid security program and run it for months before hiring for security --- and that the net result is that you're hiring that role more like how Jason Fried from Basecamp would say you should hire: when you understand the role so well that you know exactly why and how you should hire for it. We could always be wrong.
  - no_protocol 10y ago
    "Coming soon: Latacora Security Academy, graduate and we'll place you at a company with good security already in place." I would apply.
warkdarrior 10y ago
How is this different from a Managed Security Service Provider?
- tptacek 10y ago
  MSSPs manage firewalls, watch IDS alerts, and run periodic Nessus scans. They're a way of outsourcing secops teams. We can do those things (we'd recommend against some of them), but the ambit of what we're doing is much broader.
Canada 10y ago
Are you looking for/interested in partners to help do the work?
manyxcxi 10y ago
This couldn't have come at a better time for us. You shall be receiving an email on Monday as we're having to negotiate the waters of SOC compliance in order to serve certain customers of ours.
nchelluri 10y ago
Suppose I ran a small company with a small dev and ops team of 3-4 people, running a Rails app with a MySQL database, typical setup say, Nginx front end proxy to servers running mod_passenger, a separate staging and QA environment. What services would you provide to me if I paid you what I would pay a well qualified security person? Just asking out of curiosity, I've been dabbling in web/app security for the past couple years and know it's a very broad and deep field. I know about protecting against XSS, CSRF, SQL injection, and the basics of OWASP Top 10, but not sure what you'd be doing and how you would provide me service. Would it be an ongoing contract or a one time or as-needed service? As a side note: http://lcamtuf.coredump.cx/tangled/ http://lcamtuf.coredump.cx/tangled/ makes me feel like I've never considered the possibilities of anything thoroughly.
- tptacek 10y ago
  A decent short answer for this is that we'd work it out the same way you'd work it out in the hiring process for a Director of Security: by discussing your needs and determining what we were able, as "one entity", to do. The website gives a sort of sweeping idea of what things we're capable of tackling. I should add, though, that I think a lot, maybe even most, startups don't need this, or dedicated security of any kind.
somberi 10y ago
Apart from helping with better code practices may I know what other areas of expertise one can hire you for? Genuine question. Oh and all the best by the ways.

nickpsecurity 10y ago

I suggested this exact thing on Schneier's blog to keep security from being an afterthought or too expensive. Great to see a group think of and actually do the same thing. Good team for this. The prior experience will help them iterate more effectively into a model that works. Then others can copy it. Or they might even franchise it.

purpledragon 10y ago

How does this business scale without affecting quality? Why is the birth of this particular (small) security consulting firm more newsworthy (in contrast to all of the others that have popped up)?

tptacek 10y ago
1. It doesn't. 2. I don't know.
jeffmcjunkin 10y ago
1. tptacek answered this already. 2. https://news.ycombinator.com/leaders https://news.ycombinator.com/leaders (read #1)
- tptacek 10y ago
  I mean, yes, (2) is why it's on the front page, but I too find it weird that we're talking about this.

mxuribe 10y ago

This sounds like a great idea! Kudos and best of luck!

deleted 10y ago

[deleted]

lifeisstillgood 10y ago

I am working with a small startup as their "technical advisory board" - clearly not as security minded as here, but the goal is the same, to take a brain dump from me and use it as a framework for the next couple of months of work. I like this idea, and hopefully it's self selecting. People who won't listen to good advice won't hire you in the first place !

tetrep 10y ago

Ha, I guess a management role is the natural progression from technical consulting. I love the idea of a middle ground between "we have things people would want to hack" and "we have a dedicated security team." It's great when you can hire security conscious developers, but startups generally aren't know for seeking out nor emphasizing those skills. AFAIK nobody has adopted "Move carefully and write secure code with minimal technical debt." A seasoned security team would also be able to effectively avoid snake oil security consultants (no, you really don't need to encrypt the user's password with JavaScript before transmitting it to the server), which are all the more tempting to hire as they're generally cheap (run Nessus, print and deliver report...).

tptacek 10y ago
Thanks. But to be clear: we very much want to keep our hands dirty. Part of the attraction of this idea is that it's an opportunity for us to build stuff.
Normal_gaussian 10y ago
Do you hang out in #HighAltitude or am I experiencing the Baader-Meinhof Phenomenon?

lifeisstillgood 10y ago

Preamble :a lot of agencies (Im thinking postlight) act as "hire us for three months to get the idea off the ground" - they try to take away the headache of not having actually hired a good team yet. Question: Are you part of a fracturing of this? That people could hire you for security, postlight for front end, someone else for ecommerce / payments etc. I think I am asking is the postlight model distrusted, is hiring your style of team easier to fit around a growing team. What is the gap in the market you are seeing?

tptacek 10y ago
I don't think so. I think you need a solid, invested engineering team for us to plug into in order to get any value out of what we're doing.

ShaneWilton 10y ago

From the HTML source:   document.addEventListener("DOMContentLoaded", function(event) { var names = ["Erin Ptacek", "Thomas Ptacek", "Jeremy Rauch"]. sort(function(x, y) { return 1 - Math.ceil(Math.random() * 100) % 3; }); for(var i = 0; i < 3; i++) { document.getElementById("n_" + i).textContent = names[i]; } }); It isn't scientific in the slightest, but I ran the function a hundred million times, and Erin seems to appear first about 60% of the time, in Google Chrome. Good luck with the company, I hope you can also beat the RNG that makes or breaks a startup :)

tomjen3 10y ago
It is not (just) the RNG that is broken, it is using modulo - it sorts into buckets and there is no way to evenly divide 100 items into 3 buckets.
RKoutnik 10y ago
Ah, I think I've figured it out (nothing to do with JS's RNG, sadly). It's simpler when you ignore Jeremy (sorry). For this case, we can assume `Math.random()` will output uniformly random numbers. `Array.prototype.sort` works as so: If the function returns > 0, the first param should be sorted to a higher index than the second. If the function returns < 0, the first param should be sorted to a lower index than the second. If the function returns exactly zero, the parameters are left as they are. So what we've got is a 1/3 of Erin 'winning', 1/3 of Thomas 'winning' and a 1/3 chance of a tie which leaves Erin ahead. So she's got a 2/3 chance of being first. Additionally (but not in any consequential fashion), generating a random number between 1 and 100 (inclusive) gives you 100 possibilities (duh). With three outcomes: 100 / 3 = 33.333333333333336 The first option has slightly more chance to be picked. If Erin wanted to be fair(er), she'd multiply by 99. Here's a Python solution showing it's not just JS: link: http://paste.ubuntu.com/23222240/ http://paste.ubuntu.com/23222240/ results: { 'Erin Ptacek': 6523, 'Thomas Ptacek': 1951, 'Jeremy Rauch': 1526 } (with apologies to ShaneWilton, I've completely rewritten this comment so the following comments are out of date)

vemv 10y ago

Might be good to mention what programming languages do you work with, as security is quite coupled with application code...

tptacek 10y ago
I think we'll be OK. :)
wglb 10y ago
A qualified pentester can work with, audit, and break code in any language. There are a few that I have not heard of anyone actively pentesting them, and they include RPG III, and the family of Bliss languages.

djcapelis 10y ago

This is great. Someone needed to do one of these, I dabbled in this market with my little one person shop because it seemed so critically underserved, but my constraints were a bit different. Some of the challenges I faced in trying to help startups: I needed to be paid in real money, which is tough for a startup. I didn't market myself at all (not even a webpage) which is just neglectful. And finally, surprisingly: frankly I found startups to have the worst legal advice and contracts. All of them went to their lawyers and came back with contracts that looked like employment agreements and frankly included worse terms than most employment agreements. I had my own agreement, but it didn't help much. I had a surprising number of deals fall through because of this. Part of it is I clearly allowed incorrect expectations, and part of it is, I think is if people haven't heard of you they just assume you'll be unrepresented and shocked when you don't just sign their standard "we put whatever we thought would be best for our client" contract and instead asked for a version for a lawyer to redline. So frustrating. And for real, most startups didn't need that much of my time, so it became not worth it. Instead I had a much better experience with a lot less pain (and frankly more interesting work) working on multibillion dollar public infrastructure contracts (train systems mostly) and focused on those instead. Go figure. You'd expect startups to do better in this area than larger companies. Thankfully Thomas is well known on the Internet, which I think will help a lot with startups. And it's a better model than what I was doing. Anyway! Thanks for doing this! It's a huge unfilled area. Someone needed to and I hope it works well!

tptacek 10y ago
Our one key advantage: after selling Matasano, we do not require payment in real money. :)
- gingerlime 10y ago
  So you're actually investing in startups, but instead of your money, you invest your time/expertise? I don't know anything about Matasano, apart from seeing the name on HN frequently, but I was wondering if you already had a successful security consultancy and sold it, why set up another one? I guess this answers that question.
- 10y ago

richerlariviere 10y ago

>Growing a business is exciting. We'd like to make it just a little less exciting for you. The second sentence sounds weird for me. Maybe I didn't understand because I don't speak English natively and I missed some kind of humor.

anilgulecha 10y ago
Double entendre, "exciting" here refers to the fun of a startup and to security-issues and vulnerabilities in software.

briancl 10y ago

Every strong engineering team needs someone with real security chops.. not just someone who can fix SQLi after it's been pointed out, but someone who gets security at the infrastructure level. Someone who gets the why, not just the how. Not every team has that person or that person can't devote the time to play that role. With a few good references and strong VC/Accelerator connections, this boutique consulting business should do fine. The question for me is how much pain is there on the board/founder (the key influencers/buyers of the service) compared to the cost of the services... or the risk of doing nothing.

tptacek 10y ago
Most startups don't need a dedicated security person and don't need a service like ours to bridge them to a full-time internal security team. So I think you're right: boards and founders are going to question whether they want something like this. On the flip side: we have the bandwidth for only a few clients (we're doing a lot of work here), so mutual selectivity is a win. :)