Nine security questions for software companies
If you have taken a decision to improve your company’s security practices you need to do two things, understand what it is going to be worth to you and where you stand. This piece deals with the latter question.
To better assess where you stand I have created this checklist of nine simple yes and no questions that screen different areas relevant to security at a software company.
Nine simple yes and no questions. What were your answers?
What's the verdict?
Could it be time to get started?
If you answered no nine out of nine times you apparently didn’t care about security much so far. Which might be fine if you are very early stage or not if you are just deferring because you don’t know where to start.
The fact that you have taken this questionnaire already tells me that you are starting to get that nagging feeling that maybe you should start taking security seriously. If you are still in doubt maybe start reading here.
What's the verdict?
Good enough security achieved!
With nine yeses you are already doing very well. While there could be things you are missing beyond this list, you seem to have processes in place that help you become prepared.
Congratulations!
What's the verdict?
Hosting heroes
You are the most interesting case to me, as I have seen this quite a bit with my clients.
This is not uncommon because most developers understand the hosting side quite well and also worry about the risks there. It is probably the most expensive mitigation block apart from implementing and actually doing full disaster recovery though, which shows that choices about security are often not made on cost reasons alone.
In our health analogy you are already doing the hard thing of exercising three times a week for 90 minutes but just can’t hold yourself to go to the dentist for a checkup every year. Relatable but hardly logical.
Don’t stop at the hard but intellectually stimulating work. Do the easy but boring stuff too.
What's the verdict?
Somewhere in between
Like most software companies you have covered some areas and left others open. Look at the questions you answered no to: each of them maps to a concrete mitigation, and the cheapest unchecked one is usually the right next step.
Security is a fractal topic though, every question is just the tip of an iceberg of decisions, threats and mitigations.
If you want to dive deeper into any of them book a call with me.
In the absolute best case scenario your current security looks like the first chart below.
Or maybe the second because you have a lot of resources and already discovered a specific threat you are most worried about.
Security is a fractal topic though, every question is just the tip of an iceberg of decisions, threats and mitigations.
If you want to dive deeper into any of them book a call with me.
Security is a fractal topic though, every question is just the tip of an iceberg of decisions, threats and mitigations.
If you want to dive deeper into any of them book a call with me.
Security is a fractal topic though, every question is just the tip of an iceberg of decisions, threats and mitigations.
If you want to dive deeper into any of them book a call with me.