Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time investment.


To clarify, as this is a start-up we mostly do development work, so I'm looking for things to make my application more secure. Technologically agnostic, of course.


From the original Area51 proposal

share|improve this question
1  
What is your startup doing? Do you want information on security for client work, your own servers, or what? This is a massive question. –  Toby Nov 12 '10 at 13:21
    
@Toby, I agree - I just copied it verbatim from the original proposal, however I do think it's a good question. It was clear to me he was asking about security on his own development - either product, site, or client work. –  AviD Nov 13 '10 at 16:15
    
@Olivier, yours was a great answer, but I felt I had to accept @Paul answer. The emphasis on "lean" requires very lightweight activities, and "training" as a single activity will make everything else easier (i.e. a security-minded programmer will know to prevent SQLi without much extra work, but a non-security programmer that has to add protection will take MUCH MUCH longer). –  AviD Nov 16 '10 at 6:14

3 Answers 3

up vote 8 down vote accepted

Invest in secure development trainings because that would be targeting the root cause of any problem. I don't believe, given this high level of information about your startup, that you would get valuable help that you were not aware of before.

share|improve this answer
1  
+1 for training, but I think we can definitely provide some baseline recomendations and guidelines... –  AviD Nov 13 '10 at 16:20

This depends on what kind of hosting service you have.

  • Dedicated Server or virtual hosting

    • keep your system up to date.
    • use Secure protocols.
    • implement network defense. firewalls/IDS.
    • Enforce Strong password.
    • Encrypt Cookies
    • Auditing Logs
    • use threat models to prevent attacks.
    • Save Session ids in the database
    • Employing site development best-practices
  • Shared Hosting

    • Enforce Strong Password
    • Encrypt cookie data.
    • Save Session ids in the database
    • Employing site development best-practices
    • and Pray.
share|improve this answer
    
Encrypt Cookies: never seen any website do this, what is it supposed to help with? Save Session ids in the database: how does it help in regards to security? –  Olivier Lalonde Nov 12 '10 at 22:19
    
Also I doubt that this startup can afford threat modeling. –  Olivier Lalonde Nov 12 '10 at 22:26
    
@oliver what I mean is encyrpt cookie data. chec this stackoverflow.com/questions/606179/… and this codeproject.com/KB/web-security/HttpCookieEncryption.aspx. –  Mohamed Nov 13 '10 at 0:04
1  
@Olivier, I'm sure @Mohamed meant "it helps prevent tampering data" :) –  AviD Nov 13 '10 at 16:17
1  
@AviD done! feel free to up vote :D –  Olivier Lalonde Nov 15 '10 at 2:40

Securing your code:

  • Prevent SQL injection: use an ORM and parameterized queries
  • Prevent potential hackers / employees from seeing passwords: Store password hash + salt instead of clear passwords.
  • Prevent introducing security flaws: Don't reinvent the wheel. Use libraries and framework whenever you can.
  • Assess your application with a vulnerability scanner.

Securing your server:

share|improve this answer
2  
+1, because this good stuff - but I would expect more of a coding-focused answer. Clarified question. –  AviD Nov 15 '10 at 5:46
    
I've appended my answer to include some code related tips ;) –  Olivier Lalonde Nov 15 '10 at 6:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.