4 ms·

I disagree, unless your SaaS is storing highly sensitive data.

by todd3834 12y ago

TallGuyShort 12y ago
I wouldn't use a SaaS if I wasn't convinced you considered everything about me highly sensitive.
- todd3834 12y ago
  I respect your opinion and clearly the person asking the question is trying to learn how to secure the server. I do not feel like they need to hire someone to handle the security for them. However there most certainly is a difference between storing some web analytics and personal finance information.
yeukhon 12y ago
Sorry, but if your server is hacked, you lose trust, even if all you do is keeping my five years old cousin's drawing. deb.haskell.org didn't store anything sensitive, but as a server storing the .deb it was hacked and has impact on possibly ten of thousands of users. Just an example.
- todd3834 12y ago
  You are assuming that because the poster asked this question that they can't figure out how to keep their sever secure. The person is clearly making an effort to learn how to secure a server and they came to a good place to start learning. I still do not feel they should hire someone because you came up with an example where trusted binaries were being hosted got hacked. It depends on the data. If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. You have to weigh what the worst case scenario hack would cost based on your data and decide if it is worth the money saved by doing it yourself. In my opinion, for many new SaaS bootstrap products, it is totally worth doing the security yourself. At least now the poster has multiple perspectives on the matter.
  - yeukhon 12y ago
    > If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is different. Sure it may be too early to hire someone right now, but not the worst thing to think of. If OP can secure funding, get someone who has good knowledge with system and security. It's important. I am jack-of-all-trade to many, but as a devops I can't do everything at once. > storing some web analytics and personal finance information Fair. My company's finance data would be under compliance regulation, but even as a SaaS to provide easy-access easy-to-understand web analytics means you are going to have access to customer's data, or the customer is passing you data that the customer doesn't wish to share with others. Take an analytic SaaS to see your AWS usage. That requires a separate READ-ONLY access to your AWS account. Twitter recently dropped employee access to internal data. People suggest this was done to avoid insider trading. I don't know if that was the real intent, but let's take that as a yes, then web analytic is just sensitive as one's financial information. Security is not easy, just like writing code is not easy. I am suggesting OP to do some security audit before the launch. If OP ever hire someone to join the startup, try to secure a seat for someone good at security. FYI, I did some whitehat for some startup and had found numerous serious security bugs (no I am not here for hire, no time and definitely NOT as good as others, and I am 100% happy with my current job...). Just my genuine advice: don't just focus on features :)
meowface 12y ago
If you're in the bootstrap phase and don't have a lot of employees, then yes, I agree with you. But as soon as you can afford it and/or as soon as you get big enough, you should have at least one FTE who focuses purely on security. This applies to any company with an Internet presence.

I disagree, unless your SaaS is storing highly sensitive data.

TallGuyShort 12y ago

I wouldn't use a SaaS if I wasn't convinced you considered everything about me highly sensitive.

todd3834 12y ago
I respect your opinion and clearly the person asking the question is trying to learn how to secure the server. I do not feel like they need to hire someone to handle the security for them. However there most certainly is a difference between storing some web analytics and personal finance information.

yeukhon 12y ago

Sorry, but if your server is hacked, you lose trust, even if all you do is keeping my five years old cousin's drawing. deb.haskell.org didn't store anything sensitive, but as a server storing the .deb it was hacked and has impact on possibly ten of thousands of users. Just an example.

todd3834 12y ago
You are assuming that because the poster asked this question that they can't figure out how to keep their sever secure. The person is clearly making an effort to learn how to secure a server and they came to a good place to start learning. I still do not feel they should hire someone because you came up with an example where trusted binaries were being hosted got hacked. It depends on the data. If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. You have to weigh what the worst case scenario hack would cost based on your data and decide if it is worth the money saved by doing it yourself. In my opinion, for many new SaaS bootstrap products, it is totally worth doing the security yourself. At least now the poster has multiple perspectives on the matter.
- yeukhon 12y ago
  > If you follow best practices that can be learned in a afternoon, you can keep a server secure without hiring someone. Yes and no. Running a business is different. Sure it may be too early to hire someone right now, but not the worst thing to think of. If OP can secure funding, get someone who has good knowledge with system and security. It's important. I am jack-of-all-trade to many, but as a devops I can't do everything at once. > storing some web analytics and personal finance information Fair. My company's finance data would be under compliance regulation, but even as a SaaS to provide easy-access easy-to-understand web analytics means you are going to have access to customer's data, or the customer is passing you data that the customer doesn't wish to share with others. Take an analytic SaaS to see your AWS usage. That requires a separate READ-ONLY access to your AWS account. Twitter recently dropped employee access to internal data. People suggest this was done to avoid insider trading. I don't know if that was the real intent, but let's take that as a yes, then web analytic is just sensitive as one's financial information. Security is not easy, just like writing code is not easy. I am suggesting OP to do some security audit before the launch. If OP ever hire someone to join the startup, try to secure a seat for someone good at security. FYI, I did some whitehat for some startup and had found numerous serious security bugs (no I am not here for hire, no time and definitely NOT as good as others, and I am 100% happy with my current job...). Just my genuine advice: don't just focus on features :)

meowface 12y ago

If you're in the bootstrap phase and don't have a lot of employees, then yes, I agree with you. But as soon as you can afford it and/or as soon as you get big enough, you should have at least one FTE who focuses purely on security. This applies to any company with an Internet presence.