Starting Up Security
medium.com/starting-up-security · Group blog · on HN since 2015
A Medium publication by a security practitioner on building security at startups: policies, red teams, breach analysis, and risk forecasting.
What HN saysHN commenters engage with its advice on startup security, including its take on breach narratives and red team exercises, though some disagree with points.
20HN people shared it
4linked it in comments
16stories submitted
356story points
3 years agolast shared
2015people per year2026
Most-shared posts
- 1Learning from a Year of Security Breaches10 people · 344 points · first shared 2016 · 49 comments on HN
- 2An Information Security Policy for the Startup2 people · 3 points · first shared 2016 · discussion on HN
- 3Red Teams (Starting Up Security)2 people · 1 points · first shared 2016 · discussion on HN
- 4Starting Up Security1 people · 3 points · first shared 2017 · discussion on HN
- 5Preventing account takeover1 people · 2 points · first shared 2015 · discussion on HN
- 6Building a Product Security Team1 people · 1 points · first shared 2015 · discussion on HN
- 7Forecasting a headline risk: NetSpectre1 people · 1 points · first shared 2018 · discussion on HN
- 8Killing “Chicken Little”: Measure and eliminate risk through forecasting1 people · 1 points · first shared 2019 · discussion on HN
- 9You dont need a chief security officer 3f8d1a76b9241 people · first shared 2022
- 10Starting up security 87839ab21bae1 people · first shared 2018
What HN people wrote when they linked it
dsacco · 2018-03-19
> Realistically, security audits or bug bounty are not doable in seed startups - where most of the time no one has any security knowledge, and no money
Ehhhhhhh...I disagree.
1. Most of my clients tend closer to seed stage than to well-funded.
2. You don’t need security expertise or money to run a good bug bounty program. You can start one immediately. There are enough high quality resources available for free on the internet (that are not content marketing) that you can learn most of the important unknown unknowns.
For example, I think this is excellent reading for any young company thinking about security: https://medium.com/starting-up-security/starting-up-security-87839ab21…
mynameisvinn124 · 2016-12-29
"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed.
Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail.
However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack.
Thus, do not judge an adversary by the vector they’ve chosen.
An adversary may show you what “sophistication” means after advancing from their beachhead."
* https://medium.com/starting-up-security/learning-from-a-year-of-securi…
atmosx · 2016-12-20
You were part 'Red Team' incidents[1]? I can only imagine the panicked sysadmins running around like crazy, but jokes apart his is the best way to train a team's incidence response I've seen.
[1] https://medium.com/starting-up-security/red-teams-6faa8d95f602#.kfudlx…
ramimac · 2022-12-23
There is a lot of advice in this thread that doesn't actually address your circumstances, or is just bad.
I recommend reading:
1. https://devd.me/log/posts/startup-security/ - relatively short and prescriptive
2. http://scrty.io/ - start with http://scrty.io/foundations + https://medium.com/starting-up-security/you-dont-need-a-chief-security… + https://medium.com/starting-up-security/starting-up-security-policy-10…