5 ms·
Security Guide for Startups: How to think about security while moving quickly
- freeqaz 4y agoMy colleague and I wrote this blog post last week because we're constantly being bombarded with questions about how to think about security before any other type of security work has been done. Often times, the first type of security being brought into a startup is a PenTest (because of SOC2) but I feel like that provides little value to an early stage startup. Something as simple as using a hardware 2FA key for employees will never show up on a pen test, but it's extremely impactful for preventing phishing attacks. (The generated one-time code is signed to the domain, so even if it's phished successfully it's not useful.) Anyway, is anybody aware of any similar resources on the internet that would be helpful to link to other founders or people running small projects? I'd love to find some more resources to help people better understand security.