3 ms·

I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security. Whilst a sec

I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security. Whilst a security professional should take an approach like the one you describe, it a) takes time and b) experience. Things like enumerating possible risks and assigning probability require a level of experience in security which may not be something a non-specialist has. Best practice approaches are necessarily less targeted, but I think they still have value in the sense of being good starting points.

indymike 5y ago
> I'd suggest that the best practice list approach may be a function of the target audience (SAAS CTOs) who may well not be well versed in security Perhaps the best place to start is with the lack of risk aversion that most startup founders have. In my experience, your are more likely to sell a startup type on the business opportunity that being secure creates as opposed to risk. You are likely dealing with a person who cannand will go all in on pair of threes.