21

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time investment.

To clarify, as this is a start-up we mostly do development work, so I'm looking for things to make my application more secure. Technologically agnostic, of course.

From the original Area51 proposal

AviD
  • 72,138
  • 22
  • 136
  • 218
  • 1
    What is your startup doing? Do you want information on security for client work, your own servers, or what? This is a massive question. – Toby Nov 12 '10 at 13:21
  • @Toby, I agree - I just copied it verbatim from the original proposal, however I do think it's a good question. It was clear to me he was asking about security on his own development - either product, site, or client work. – AviD Nov 13 '10 at 16:15
  • @Olivier, yours was a great answer, but I felt I had to accept @Paul answer. The emphasis on "lean" requires very lightweight activities, and "training" as a single activity will make everything else easier (i.e. a security-minded programmer will know to prevent SQLi without much extra work, but a non-security programmer that has to add protection will take MUCH MUCH longer). – AviD Nov 16 '10 at 06:14

3 Answers3

13

Securing your code:

  • Prevent SQL injection: use an ORM and parameterized queries
  • Prevent potential hackers / employees from seeing passwords: Store password hash + salt instead of clear passwords.
  • Prevent introducing security flaws: Don't reinvent the wheel. Use libraries and framework whenever you can.
  • Assess your application with a vulnerability scanner.

Securing your server:

Community
  • 1
Olivier Lalonde
  • 5,039
  • 8
  • 31
  • 35
8

Invest in secure development trainings because that would be targeting the root cause of any problem. I don't believe, given this high level of information about your startup, that you would get valuable help that you were not aware of before.

Phoenician-Eagle
  • 2,167
  • 16
  • 21
  • 1
    +1 for training, but I think we can definitely provide some baseline recomendations and guidelines... – AviD Nov 13 '10 at 16:20
4

This depends on what kind of hosting service you have.

  • Dedicated Server or virtual hosting

    • keep your system up to date.
    • use Secure protocols.
    • implement network defense. firewalls/IDS.
    • Enforce Strong password.
    • Encrypt Cookies
    • Auditing Logs
    • use threat models to prevent attacks.
    • Save Session ids in the database
    • Employing site development best-practices

  • Shared Hosting

    • Enforce Strong Password
    • Encrypt cookie data.
    • Save Session ids in the database
    • Employing site development best-practices
    • and Pray.
Mohamed
  • 1,404
  • 1
  • 11
  • 14