20

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time investment.


To clarify, as this is a start-up we mostly do development work, so I'm looking for things to make my application more secure. Technologically agnostic, of course.


From the original Area51 proposal

  • 1
    What is your startup doing? Do you want information on security for client work, your own servers, or what? This is a massive question. – Toby Nov 12 '10 at 13:21
  • @Toby, I agree - I just copied it verbatim from the original proposal, however I do think it's a good question. It was clear to me he was asking about security on his own development - either product, site, or client work. – AviD Nov 13 '10 at 16:15
  • @Olivier, yours was a great answer, but I felt I had to accept @Paul answer. The emphasis on "lean" requires very lightweight activities, and "training" as a single activity will make everything else easier (i.e. a security-minded programmer will know to prevent SQLi without much extra work, but a non-security programmer that has to add protection will take MUCH MUCH longer). – AviD Nov 16 '10 at 6:14
8

Invest in secure development trainings because that would be targeting the root cause of any problem. I don't believe, given this high level of information about your startup, that you would get valuable help that you were not aware of before.

  • 1
    +1 for training, but I think we can definitely provide some baseline recomendations and guidelines... – AviD Nov 13 '10 at 16:20
13

Securing your code:

  • Prevent SQL injection: use an ORM and parameterized queries
  • Prevent potential hackers / employees from seeing passwords: Store password hash + salt instead of clear passwords.
  • Prevent introducing security flaws: Don't reinvent the wheel. Use libraries and framework whenever you can.
  • Assess your application with a vulnerability scanner.

Securing your server:

  • 2
    +1, because this good stuff - but I would expect more of a coding-focused answer. Clarified question. – AviD Nov 15 '10 at 5:46
  • I've appended my answer to include some code related tips ;) – Olivier Lalonde Nov 15 '10 at 6:22
4

This depends on what kind of hosting service you have.

  • Dedicated Server or virtual hosting

    • keep your system up to date.
    • use Secure protocols.
    • implement network defense. firewalls/IDS.
    • Enforce Strong password.
    • Encrypt Cookies
    • Auditing Logs
    • use threat models to prevent attacks.
    • Save Session ids in the database
    • Employing site development best-practices
  • Shared Hosting

    • Enforce Strong Password
    • Encrypt cookie data.
    • Save Session ids in the database
    • Employing site development best-practices
    • and Pray.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.