Nine security questions for software companies

If you have taken a decision to improve your company’s security practices you need to do two things, understand what it is going to be worth to you and where you stand. This piece deals with the latter question.

To better assess where you stand I have created this checklist of nine simple yes and no questions that screen different areas relevant to security at a software company.

Organizational mitigations

Do you use 2FA on every account possible?

Yes No

Are you doing scheduled penetration testing of your software?

Yes No

Have you ever done disaster recovery for your system? Meaning a full restore, not just recovering single files.

Yes No

Hosting mitigations

Do you have a private network or firewall? At a minimum the DB is not accessible from every IP

Yes No

Are you using a secrets store for production?

Yes No

Do your services run with the least privileges possible?

Yes No

Dependency mitigations

Are you enforcing dependency cooldowns? A waiting period before you adopt a new package version.

Yes No

Do you subscribe to the CVE warnings for your entire stack? eg. dependabot or OpenCVE

Yes No

Do you have firm policies for developer machine security?

Yes No

Nine simple yes and no questions. What were your answers?

Nine security questions for software companies

What's the verdict?