6 ms·

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item

I really like this idea - alot. But aimed perhaps at everyone, not just the CTO. In fact the CTO probably needs one thing on their checklist. Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly". And if the company has the financial resources: Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist quarterly". I don't see any value in relating anything to the financial stage of the company because it's irrelevant. Security also needs a time and priority aspect to it. For example if your company hasn't done anything on the checklist yet then what should come first, what is most important? Also it would be good to know what are the biggest typical weaknesses - a security chedclist can have so much stuff on it that it becomes hard to know where to focus.

laurentl 7y ago
> Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought. > I don't see any value in relating anything to the financial stage of the company because it's irrelevant. It is extremely relevant, for at least two reasons. The first one is that the company’s financial resources dictate what you can or cannot do (e.g. hire a dedicated security resource, pay for pen testing). The second is that some recommendations just don’t make sense before a certain size (e.g. there’s no sense in setting up an AD and GPOs when there’s just 3 of you in the company).
- deleted 7y ago
  [deleted]
- jammygit 7y ago
  How lucrative is security work? It’s a direction I’ve been considering moving towards but the salary info I’ve seen is not great. Am I looking up the wrong terms/titles?
  - tptacek 7y ago
    As an employee, application and infrastructure security work pays somewhat better than normal product engineering work (there are good jobs and bad jobs, of course). There are lots of security jobs that don't pay especially well and are career dead-ends --- enteprise IT security isn't a good place to end up, nor is sales engineering ("security engineer") for security product companies, nor is malware analysis. My feeling is that software/application security consulting is a reasonable route to go, if you want to work for a consultancy, but I'd be wary of any other kind of security consulting.
    - jammygit 7y ago
      Thanks for the insight!
jdreyfuss 7y ago
Checklist author here. Glad you liked the idea! Figuring out a clean shorthand way to group these best practices was something we definitely thought about. The idea behind using funding rounds was to find something that can work as an easily digestible placeholder for company maturity and capabilities for most SaaS startups. Something closer to “just starting out,” “product-market fit,” and “starting to scale” rather than being specifically about actual funding levels. Definitely open to feedback if that way of grouping things doesn't resonate!
- deleted 7y ago
  [deleted]
- andrewstuart 7y ago
  Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist". Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item. Then give each checklist item and owner and assign action items, status and followup discussion. The outcome of that is something the CTO would be interested in because it would be a dashboard with accountability.
  - jdreyfuss 7y ago
    Cool idea! I like the self-assessment angle. We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.
    - andrewstuart 7y ago
      The "SAAS security dashboard". Grab that domain! Features: - Including an overall alert status red/yellow/green. - Critical issues rise to the top somehow for the team's attention. - Mechanisms and best practices for reporting security issues. - A knowledge base linking to relevant articles on each topic. - A button must be pressed to say that backups have been tested, failing to do so raises alert level. - Team members jointly contribute ratings out of 10 for the companies security practice in each checklist item - Team discussions/actions/priorities. - Register your companies tech stack with the service and it sweeps the net for security reports about stuff that you use. - Integrate ansible to gather information about the versions of the software you are using and issue dashboard alerts when stuff in your software stack is vulnerable to attack. - $5,000/month - database lives on client site etc etc Don't know why I give these ideas away for free. Maybe I'll get onto building it!
tptacek 7y ago
Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.
- rorykoehler 7y ago
  We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.
  - tptacek 7y ago
    Continuous assessment is good (tool-driven continuous assessment can be sketchy), and is a norm at larger tech companies. Quarterly 3rd party assessments aren't, even at large companies (big companies might get many more than 4 audits per year, but will not as a rule re-assess things more often than annually or at major revisions).
- jkirsteins 7y ago
  > but then, I guess I don't think this checklist does, either. Why do you say that? Do you think the items on the list are not useful/well prioritized? Or that most companies are not positioned/incentivized to follow most of this advice?
rorykoehler 7y ago
>if your company hasn't done anything on the checklist yet then what should come first, what is most important? Security practitioners like to use the risk analysis matrix for this exact reason. One axis is likelihood of problem occurring (ranging from unlikely to almost certain) and the other is impact problem occurring will have on the business (ranging from embarrassing to bankrupting the business). As you can immediately see this is a very good tool to focus the efforts on the right remdiations.
scarface74 7y ago
What are the chances that the security auditing firm is going to look through code and find var sql = “select * from Users where firstname = ‘“ + firstname + “‘“; Or var s3 = new S3Client(secret_key,access_key)

laurentl 7y ago

> Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought. > I don't see any value in relating anything to the financial stage of the company because it's irrelevant. It is extremely relevant, for at least two reasons. The first one is that the company’s financial resources dictate what you can or cannot do (e.g. hire a dedicated security resource, pay for pen testing). The second is that some recommendations just don’t make sense before a certain size (e.g. there’s no sense in setting up an AD and GPOs when there’s just 3 of you in the company).

deleted 7y ago
[deleted]
jammygit 7y ago
How lucrative is security work? It’s a direction I’ve been considering moving towards but the salary info I’ve seen is not great. Am I looking up the wrong terms/titles?
- tptacek 7y ago
  As an employee, application and infrastructure security work pays somewhat better than normal product engineering work (there are good jobs and bad jobs, of course). There are lots of security jobs that don't pay especially well and are career dead-ends --- enteprise IT security isn't a good place to end up, nor is sales engineering ("security engineer") for security product companies, nor is malware analysis. My feeling is that software/application security consulting is a reasonable route to go, if you want to work for a consultancy, but I'd be wary of any other kind of security consulting.
  - jammygit 7y ago
    Thanks for the insight!

jdreyfuss 7y ago

Checklist author here. Glad you liked the idea! Figuring out a clean shorthand way to group these best practices was something we definitely thought about. The idea behind using funding rounds was to find something that can work as an easily digestible placeholder for company maturity and capabilities for most SaaS startups. Something closer to “just starting out,” “product-market fit,” and “starting to scale” rather than being specifically about actual funding levels. Definitely open to feedback if that way of grouping things doesn't resonate!

deleted 7y ago
[deleted]
andrewstuart 7y ago
Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist". Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item. Then give each checklist item and owner and assign action items, status and followup discussion. The outcome of that is something the CTO would be interested in because it would be a dashboard with accountability.
- jdreyfuss 7y ago
  Cool idea! I like the self-assessment angle. We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.
  - andrewstuart 7y ago
    The "SAAS security dashboard". Grab that domain! Features: - Including an overall alert status red/yellow/green. - Critical issues rise to the top somehow for the team's attention. - Mechanisms and best practices for reporting security issues. - A knowledge base linking to relevant articles on each topic. - A button must be pressed to say that backups have been tested, failing to do so raises alert level. - Team members jointly contribute ratings out of 10 for the companies security practice in each checklist item - Team discussions/actions/priorities. - Register your companies tech stack with the service and it sweeps the net for security reports about stuff that you use. - Integrate ansible to gather information about the versions of the software you are using and issue dashboard alerts when stuff in your software stack is vulnerable to attack. - $5,000/month - database lives on client site etc etc Don't know why I give these ideas away for free. Maybe I'll get onto building it!

tptacek 7y ago

Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.

rorykoehler 7y ago
We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.
- tptacek 7y ago
  Continuous assessment is good (tool-driven continuous assessment can be sketchy), and is a norm at larger tech companies. Quarterly 3rd party assessments aren't, even at large companies (big companies might get many more than 4 audits per year, but will not as a rule re-assess things more often than annually or at major revisions).
jkirsteins 7y ago
> but then, I guess I don't think this checklist does, either. Why do you say that? Do you think the items on the list are not useful/well prioritized? Or that most companies are not positioned/incentivized to follow most of this advice?

rorykoehler 7y ago

>if your company hasn't done anything on the checklist yet then what should come first, what is most important? Security practitioners like to use the risk analysis matrix for this exact reason. One axis is likelihood of problem occurring (ranging from unlikely to almost certain) and the other is impact problem occurring will have on the business (ranging from embarrassing to bankrupting the business). As you can immediately see this is a very good tool to focus the efforts on the right remdiations.

scarface74 7y ago

What are the chances that the security auditing firm is going to look through code and find var sql = “select * from Users where firstname = ‘“ + firstname + “‘“; Or var s3 = new S3Client(secret_key,access_key)