22

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time investment.


To clarify, as this is a start-up we mostly do development work, so I'm looking for things to make my application more secure. Technologically agnostic, of course.


From the original Area51 proposal

3
  • 1
    What is your startup doing? Do you want information on security for client work, your own servers, or what? This is a massive question.
    – Toby
    Nov 12, 2010 at 13:21
  • @Toby, I agree - I just copied it verbatim from the original proposal, however I do think it's a good question. It was clear to me he was asking about security on his own development - either product, site, or client work.
    – AviD
    Nov 13, 2010 at 16:15
  • @Olivier, yours was a great answer, but I felt I had to accept @Paul answer. The emphasis on "lean" requires very lightweight activities, and "training" as a single activity will make everything else easier (i.e. a security-minded programmer will know to prevent SQLi without much extra work, but a non-security programmer that has to add protection will take MUCH MUCH longer).
    – AviD
    Nov 16, 2010 at 6:14

3 Answers 3

9

Invest in secure development trainings because that would be targeting the root cause of any problem. I don't believe, given this high level of information about your startup, that you would get valuable help that you were not aware of before.

1
  • 1
    +1 for training, but I think we can definitely provide some baseline recomendations and guidelines...
    – AviD
    Nov 13, 2010 at 16:20
13

Securing your code:

  • Prevent SQL injection: use an ORM and parameterized queries
  • Prevent potential hackers / employees from seeing passwords: Store password hash + salt instead of clear passwords.
  • Prevent introducing security flaws: Don't reinvent the wheel. Use libraries and framework whenever you can.
  • Assess your application with a vulnerability scanner.

Securing your server:

2
  • 2
    +1, because this good stuff - but I would expect more of a coding-focused answer. Clarified question.
    – AviD
    Nov 15, 2010 at 5:46
  • I've appended my answer to include some code related tips ;) Nov 15, 2010 at 6:22
4

This depends on what kind of hosting service you have.

  • Dedicated Server or virtual hosting

    • keep your system up to date.
    • use Secure protocols.
    • implement network defense. firewalls/IDS.
    • Enforce Strong password.
    • Encrypt Cookies
    • Auditing Logs
    • use threat models to prevent attacks.
    • Save Session ids in the database
    • Employing site development best-practices
  • Shared Hosting

    • Enforce Strong Password
    • Encrypt cookie data.
    • Save Session ids in the database
    • Employing site development best-practices
    • and Pray.
10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .