3 ms·

Others mention important things but go nowhere near as far as they should. I can list dozens of high level things you should have on that list, but I think the

by _8j50 4y ago

Others mention important things but go nowhere near as far as they should. I can list dozens of high level things you should have on that list, but I think the most important decision is at what point will you hire a dedicated career-security person? The earlier the better. You can have protected branches, pubkey auth everywhere with yubikeys and macs everywhere it all helps reduce noise but security architecture ensures there are no cracks in your defenses. These checklist solutions can do more harm than good by leaving you with the impression that you have a better security-posture and risk appettite than you actually do leading you to make catastrophic decisions. IT/OPs/Engineering folks who know enough security to be dangerous would say things like "but _____ defensive measure is there,that wouldn't work" or "if they got past all this then we have bigger issues anyways" and be dangerously wrong. 2FA with yubi? Cookie theft is now popular. SSH pubkey on a mac? Commodity multiplatform stealers in Rust and Golang of course are a thing and they include stealing private keys and sensitive files as a feature. MDM doesn't protect you against malware and SSO while still should be implemented makes cookie theft one working attack away from pwning all things the user has access to. Boring old things like segmentation, (good)logging and proactive monitoring (probably MSP for you at the start) are still top of the "list" and despite what pop-security personalities have you believe, not only do you need AV but you need a cross-platform good EDR as soon as possible as well as corporate VPNs and while gsuite is popular with startups, O365 has better security and DLP. I could go on but my point is you at least need a consultant at the begining and have a solid plan on when you will hire a proper security pro to architect things and make all the devs and engineers do things they disagree with passionately leading some to even leave lol.

tptacek 4y ago
O365 and DLP are absolutely not startup best practices. Almost nobody uses either. As I've noted elsewhere on the thread, the norm among startups is to make a first security hire somewhere between engineer #20 and #40. Pentesters usually get brought in after PMF, sometime around the "first version" of the product the startup settles on.
- _8j50 4y ago
  "Almost nobody uses either." I am very aware, I noted that in my comment. Are you saying O365 and AIP are inferior than gsuite, if so I would like to hear why, I don't favor either I just haven't seen why. DLP is absolutley a foundational security practice, especially for a startup because they usually have some "secret sauce" and all it takes is one employee leaking that and most people that leak/sell-out just print or take the document with them, a starup maybe drowning in VC money but it all comes down crashing the moment you someone else does it better. As far as the security hire and pentesters, I don't particulary mind the norm so long as you made that decision and planned on it from the start. Also on O365, if you're a mac shop I still say it's better but for windows shops (as rare as that is at a startup) you must use AAD and it solves a lot of problems out of the box when you marry it with O365 and you don't have to worry about google banning you on a whim and crashing your business. I am all for best practices but those are different than monkey-see-moneky-do copying without critically reasoning and defining why that decision is best.
  - tptacek 4y ago
    DLP is not a foundational security practice. It's a product category and little else. I've spent a good chunk of time in my career working on DLP[1], mostly at large enterprises (the only place this gets seriously deployed), and I've never seen it do anything useful. I can count on zero fingers the number of startups that buy and operate these tools. In the entire history of startups, no startup has ever outcompeted another based on DLP. Startups overwhelmingly use Google. I'm not interested in arguing with you about how startups should use Windows, or Active Directory; it's just not relevant. The question was asked "what's the checklist for startups", not "what's the checklist for AON". [1] https://www.darkreading.com/risk/black-hat-dlp-hack https://www.darkreading.com/risk/black-hat-dlp-hack
    - _8j50 4y ago
      Again you mention the number of startups that do something, how is that relevant without reasoning why that is good? I don't know the entire history of startups or for that matter DLP more than you do but mistakes and sabotage happen at any commercial entity and this is not an easy problem to solve at large enterprises as you probably know even more than myself, but as a startup you can define data classification and handling policies early on and a DLP is just a tool to help you enforce that and by DLP I don't mean a firewall but MS Information Protection in this case. You control how secret and sensitive information is shared and stored. You use it to build a solid culture of secure data handling. It becomes more costly and difficult as you grow larger and you avoid costly mistakes and sabotage because you have a good handle on where your data is and how it flows. My point wasn't that startup should implement MSIP/DLP and O365 but that a checklist on HN and copycatting is not the best way. Get a consultant to help you get things straight based on your specific business goals/needs (maybe you will cash out in 5 years and just don't care so get gsuite and take the risk). There is no generic one size fits all checklist where if you do those things that means your random startup's security is going in the right direction. If you're fintech or work with government contracts you really do need MSIP or the equivalent, if you're selling a new cool database product that is FOSS maybe you're like a decade away from even considering it. My post was anti-checklist mainly. If you care about security let a pro help you plan it according to your needs instead if checking a few boxes and hoping that was enough. And startups do get hacked and get their data stolen although most won't advertise it to the public.

by _8j50 4y ago

tptacek 4y ago

O365 and DLP are absolutely not startup best practices. Almost nobody uses either. As I've noted elsewhere on the thread, the norm among startups is to make a first security hire somewhere between engineer #20 and #40. Pentesters usually get brought in after PMF, sometime around the "first version" of the product the startup settles on.

_8j50 4y ago
"Almost nobody uses either." I am very aware, I noted that in my comment. Are you saying O365 and AIP are inferior than gsuite, if so I would like to hear why, I don't favor either I just haven't seen why. DLP is absolutley a foundational security practice, especially for a startup because they usually have some "secret sauce" and all it takes is one employee leaking that and most people that leak/sell-out just print or take the document with them, a starup maybe drowning in VC money but it all comes down crashing the moment you someone else does it better. As far as the security hire and pentesters, I don't particulary mind the norm so long as you made that decision and planned on it from the start. Also on O365, if you're a mac shop I still say it's better but for windows shops (as rare as that is at a startup) you must use AAD and it solves a lot of problems out of the box when you marry it with O365 and you don't have to worry about google banning you on a whim and crashing your business. I am all for best practices but those are different than monkey-see-moneky-do copying without critically reasoning and defining why that decision is best.
- tptacek 4y ago
  DLP is not a foundational security practice. It's a product category and little else. I've spent a good chunk of time in my career working on DLP[1], mostly at large enterprises (the only place this gets seriously deployed), and I've never seen it do anything useful. I can count on zero fingers the number of startups that buy and operate these tools. In the entire history of startups, no startup has ever outcompeted another based on DLP. Startups overwhelmingly use Google. I'm not interested in arguing with you about how startups should use Windows, or Active Directory; it's just not relevant. The question was asked "what's the checklist for startups", not "what's the checklist for AON". [1] https://www.darkreading.com/risk/black-hat-dlp-hack https://www.darkreading.com/risk/black-hat-dlp-hack
  - _8j50 4y ago
    Again you mention the number of startups that do something, how is that relevant without reasoning why that is good? I don't know the entire history of startups or for that matter DLP more than you do but mistakes and sabotage happen at any commercial entity and this is not an easy problem to solve at large enterprises as you probably know even more than myself, but as a startup you can define data classification and handling policies early on and a DLP is just a tool to help you enforce that and by DLP I don't mean a firewall but MS Information Protection in this case. You control how secret and sensitive information is shared and stored. You use it to build a solid culture of secure data handling. It becomes more costly and difficult as you grow larger and you avoid costly mistakes and sabotage because you have a good handle on where your data is and how it flows. My point wasn't that startup should implement MSIP/DLP and O365 but that a checklist on HN and copycatting is not the best way. Get a consultant to help you get things straight based on your specific business goals/needs (maybe you will cash out in 5 years and just don't care so get gsuite and take the risk). There is no generic one size fits all checklist where if you do those things that means your random startup's security is going in the right direction. If you're fintech or work with government contracts you really do need MSIP or the equivalent, if you're selling a new cool database product that is FOSS maybe you're like a decade away from even considering it. My post was anti-checklist mainly. If you care about security let a pro help you plan it according to your needs instead if checking a few boxes and hoping that was enough. And startups do get hacked and get their data stolen although most won't advertise it to the public.