Hacker News Reader

Comment by tptacek | Hacker News Reader

I guess if people are interested and have questions I can try to take a stab at them, but really you'll be having a conversation with three people who have only a faint idea of exactly how this is going to work, since we're still in learning mode. :)

The next thing I'm actually shipping is the first batch of post-Starfighter challenges.

The next thing I'm actually writing is "what happened with Starfighter".

View on HN

Suppose I ran a small company with a small dev and ops team of 3-4 people, running a Rails app with a MySQL database, typical setup say, Nginx front end proxy to servers running mod_passenger, a separate staging and QA environment. What services would you provide to me if I paid you what I would pay a well qualified security person?

Just asking out of curiosity, I've been dabbling in web/app security for the past couple years and know it's a very broad and deep field. I know about protecting against XSS, CSRF, SQL injection, and the basics of OWASP Top 10, but not sure what you'd be doing and how you would provide me service. Would it be an ongoing contract or a one time or as-needed service?

As a side note: http://lcamtuf.coredump.cx/tangled/ makes me feel like I've never considered the possibilities of anything thoroughly.

A decent short answer for this is that we'd work it out the same way you'd work it out in the hiring process for a Director of Security: by discussing your needs and determining what we were able, as "one entity", to do. The website gives a sort of sweeping idea of what things we're capable of tackling.

I should add, though, that I think a lot, maybe even most, startups don't need this, or dedicated security of any kind.

This seems quite useful. Will you help find/place the right first hire for when companies outgrow you?

That's the critical final selling point for me. Great, you've taken security off my plate in a small business. But now I'm disengaged from the security side of things when it comes time to find the first full time security hire.

Very cool though. Good luck!

Yes, we will. We want to be the bridge --- for maybe, I don't know, 9-18 months? --- between "we've reached the point where we think we need a security team" and "we've been doing security long enough as a team that we know what we need for a full-time lead security person".

There's a weird adolescence that happens between those two points where we see people struggling to staff effectively.

We think we can get companies to a point where they've built a solid security program and run it for months before hiring for security --- and that the net result is that you're hiring that role more like how Jason Fried from Basecamp would say you should hire: when you understand the role so well that you know exactly why and how you should hire for it.

We could always be wrong.

"Coming soon: Latacora Security Academy, graduate and we'll place you at a company with good security already in place."

I would apply.

How is this different from a Managed Security Service Provider?

MSSPs manage firewalls, watch IDS alerts, and run periodic Nessus scans. They're a way of outsourcing secops teams. We can do those things (we'd recommend against some of them), but the ambit of what we're doing is much broader.

This couldn't have come at a better time for us. You shall be receiving an email on Monday as we're having to negotiate the waters of SOC compliance in order to serve certain customers of ours.

Apart from helping with better code practices may I know what other areas of expertise one can hire you for? Genuine question. Oh and all the best by the ways.

Is it pronounced lata-cora or la-taco-ra?

Dunno. What sounds better? La-TACO-ra hadn't even occurred to me.

I read it as later-kora

lata-cora rolls off the tongue easier, imo. (I think i am just hungry)

I like tacos, but the latter sounds more like a food truck than a security company.

Are you looking for/interested in partners to help do the work?

Reply on news.ycombinator.com