Hacker News Reader

Hacker News

Comment by andrewstuart | Hacker News Reader

Full thread

andrewstuart

I really like this idea - alot.

But aimed perhaps at everyone, not just the CTO.

In fact the CTO probably needs one thing on their checklist.

Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly".

And if the company has the financial resources:

Checklist item 2: Hire a second, independent outside security auditing firm to report on the state of this checklist quarterly".

I don't see any value in relating anything to the financial stage of the company because it's irrelevant.

Security also needs a time and priority aspect to it. For example if your company hasn't done anything on the checklist yet then what should come first, what is most important? Also it would be good to know what are the biggest typical weaknesses - a security chedclist can have so much stuff on it that it becomes hard to know where to focus.

View on HN

> Checklist item 1: Hire an outside security auditing firm to report on the state of this checklist quarterly

Security auditing firms cost a lot of money. Money you don’t have when you’re a small startup. Besides, an auditor audits and the hard part about this list is implementing it. Until you can afford to hire someone to take care of security, it’s usually the CTO’s job to make sure security is not an afterthought.

> I don't see any value in relating anything to the financial stage of the company because it's irrelevant.

It is extremely relevant, for at least two reasons. The first one is that the company’s financial resources dictate what you can or cannot do (e.g. hire a dedicated security resource, pay for pen testing). The second is that some recommendations just don’t make sense before a certain size (e.g. there’s no sense in setting up an AD and GPOs when there’s just 3 of you in the company).

How lucrative is security work? It’s a direction I’ve been considering moving towards but the salary info I’ve seen is not great. Am I looking up the wrong terms/titles?

As an employee, application and infrastructure security work pays somewhat better than normal product engineering work (there are good jobs and bad jobs, of course).

There are lots of security jobs that don't pay especially well and are career dead-ends --- enteprise IT security isn't a good place to end up, nor is sales engineering ("security engineer") for security product companies, nor is malware analysis.

My feeling is that software/application security consulting is a reasonable route to go, if you want to work for a consultancy, but I'd be wary of any other kind of security consulting.

Thanks for the insight!

>if your company hasn't done anything on the checklist yet then what should come first, what is most important?

Security practitioners like to use the risk analysis matrix for this exact reason. One axis is likelihood of problem occurring (ranging from unlikely to almost certain) and the other is impact problem occurring will have on the business (ranging from embarrassing to bankrupting the business). As you can immediately see this is a very good tool to focus the efforts on the right remdiations.

Quarterly audits are very much out of the norm among SAAS startups. Checklists that don't reflect reality don't help anybody --- but then, I guess I don't think this checklist does, either.

We use tools for automatic continuous assessment against a bunch of standards. They're not perfect but they help separate the signal from the noise immensely.

Continuous assessment is good (tool-driven continuous assessment can be sketchy), and is a norm at larger tech companies. Quarterly 3rd party assessments aren't, even at large companies (big companies might get many more than 4 audits per year, but will not as a rule re-assess things more often than annually or at major revisions).

> but then, I guess I don't think this checklist does, either.

Why do you say that? Do you think the items on the list are not useful/well prioritized? Or that most companies are not positioned/incentivized to follow most of this advice?

Checklist author here. Glad you liked the idea!

Figuring out a clean shorthand way to group these best practices was something we definitely thought about. The idea behind using funding rounds was to find something that can work as an easily digestible placeholder for company maturity and capabilities for most SaaS startups. Something closer to “just starting out,” “product-market fit,” and “starting to scale” rather than being specifically about actual funding levels.

Definitely open to feedback if that way of grouping things doesn't resonate!

Maybe this concept should just get rid of the CTO aspect and position it as the "SaaS security checklist".

Then gamify it so that all the technical people in the team can each give their independent rating of how the company performs on each checklist item.

Then give each checklist item and owner and assign action items, status and followup discussion.

The outcome of that is something the CTO would be interested in because it would be a dashboard with accountability.

Cool idea! I like the self-assessment angle.

We wrote this for CTOs since prior to hiring a dedicated security engineer, security responsibilities in a company often fall to the CTO. But really, any more technical person in a company with some ownership or interest in security can leverage this.

The "SAAS security dashboard". Grab that domain!

Features:

- Including an overall alert status red/yellow/green.

- Critical issues rise to the top somehow for the team's attention.

- Mechanisms and best practices for reporting security issues.

- A knowledge base linking to relevant articles on each topic.

- A button must be pressed to say that backups have been tested, failing to do so raises alert level.

- Team members jointly contribute ratings out of 10 for the companies security practice in each checklist item

- Team discussions/actions/priorities.

- Register your companies tech stack with the service and it sweeps the net for security reports about stuff that you use.

- Integrate ansible to gather information about the versions of the software you are using and issue dashboard alerts when stuff in your software stack is vulnerable to attack.

- $5,000/month

- database lives on client site

etc etc

Don't know why I give these ideas away for free. Maybe I'll get onto building it!

I did - early beta. Based on my experience as CISO for SaaS a well as running security engineer team at a Fortune 5 company, performing Tier 1 PCI DSS, NESA, scans, etc https://joinsecurekit.com/

This sounds really good! I've just signed and I would definitely use this. I'd be happy to help with beta testing.

Would you be able to share some details about the pricing and business model?

EDIT: I get a "You are already signed in" error when I try to fill out the welcome form: https://www.dropbox.com/s/bfxfpm2tczbyn7d/Screen%20Shot%2020...

A lot of these features are actually already inside our product Sqreen, but it "only" starts at $250/month.

We're also hiring if you want to help us build the missing items ;)

What are the chances that the security auditing firm is going to look through code and find

  var sql = “select * from Users where firstname = ‘“ + firstname + “‘“;

  var s3 = new S3Client(secret_key,access_key)

Reply on news.ycombinator.com