Hacker News Reader

Comment by xtracto | Hacker News Reader

Ha! I've has the chance to be in charge of technology (including its security) in two different start ups.

The first one was B2C (60+ ppl post Series A). My CEO just did not care about security even though we (myself and our internal security expert) warned about it. No dev cycles had priority for security improvement. For me it was always an uphill battle to sell the need of security .

This all changed in the 2nd startup. This was a B2B. That was the blessing: as sales go upmarket, larger prospects questioned sales about our security, soc2, pci, gdpr, ccpa, etc .

As the tech head it is A PLEASURE that I dont have to fight for that. The Sales team fights for it because otherwise they lose deals.

View on HN

I've also run tech for a 60 person startup, run security for a 300 person company, and worked closely with security & compliance at a 6000 person company.

What I will say is there is a lot of waste and overhead in the tech security industry overall. You can pay a vendor any amount of money you can afford, and they will add some incremental value via automated scanning, pentests, compliance reporting, but the value has no correlation to the money spent unless you have no baseline security awareness to begin with, and if you don't have that then no amount of money will save you (eg. Equifax breach).

IMHO the right way to do it is: make sure your tech and infra leadership have baseline understanding and do the fundamentals right (eg. use bcrypt, put your infra in VPCs with private subnet and bastion only access, use IAMs with least privilege, etc). The incremental cost of those things is negligible if you know what you are doing, so make sure you have at least one person on the early-stage team who knows what they're doing. Next step up (if you are consumer app) do a bug bounty and minimal scanners (prioritize infra scans). Eventually you'll need more, but it should be a function of success where you have hundreds of engineers, are making tons of money, or have specific compliance requirements as a result of lucrative enterprise sales.

> For me it was always an uphill battle to sell the need of security

60+ ppl is pretty far along where other security aspects besides infosec also start showing up (e.g. securing employee computers, etc). Was this because tech-debt in general wasn't a priority or security specific improvements weren't seen as important?

Reply on news.ycombinator.com