When do I need to start taking it seriously?

In Humble beginnings I have hinted that there comes a time when you should probably no longer ignore security concerns in your venture. While putting a pin into the exact point in time can be difficult the logic is easy to understand.

Cost and benefit

The cost of your security mitigations surely rises with the size and complexity of your business but not as fast as the value of your business will.

At one extreme you have no product and no customers so what is there really to lose. At the other end you are a Fortune 500 enterprise and I would bet a lot of money not a single one has nobody responsible for cyber security.

So when is the cross over point? It’s when the benefit of having security measures in place exceeds the cost of putting them in place.

Value of your business

The value of having security is directly proportional to the value of your business, because that or at least a part of it is what you stand to lose in case of data loss or a breach.

The value of your business to you is whatever the lowest price you would sell it for. In case of a freelancer it is probably only the part of your earnings that exceeds what you’d make in a job you are confident of getting. Or maybe the extra money someone would have to pay you to take a job and lose the lifestyle benefits you have created for yourself.

Value of security

The value of security is clearly not just the value of your business. That is because even one completely ignorant of security stands to lose the entire business or is certain to have an incident.

If your business is heavily concentrated with a single client and you have a security incident involving them you could lose the entire business with them.

A business with no backups and restore capabilities could lose so much of their customers data that they cease to be your clients entirely.

At the very least you would spend a ton of effort and time to restore your systems and regain trust with the clients that experienced the issue. In rare cases you might even be fined by a regulator or lose an important license.

How much is worth it to you, that your clients don’t think your are irresponsible or incompetent?

Chance of an incident

While it can be very hard to estimate correctly how likely you will have any kind of incident, I’d venture to say for companies that don’t have any formal process the chances are probably as high as 10% a year. Interestingly very big companies basically expect it to happen and thus not only concentrate on reducing the chance of an incident but to limit the blast radius of one happening.

How low can you go? It is anyones guess but I have personally run many web facing applications for more than a decade without a security breach. On the other hand I took over a project with very lax practices that had a massive data loss in less than 4 years of operation.