Saas CTO Security Checklist
It's not a bad list, though it is a bit of a marketing tool for "Sqreen" (though, I guess if we did one, it'd come off as a marketing tool for us).<p>What I actively don't like is their use of "Seed", "Series A", "Post-Series-A". It's cutesy but, more importantly, their categories are mostly wrong.<p>Here's their "Series A" list:<p>* No shared accounts
* Centralized account management
* Centralized logs
* Server list
* DDoS protection
* IP restrictions for internal services
* Monitor metrics
* Public security policy
* Special security for non-tech staff
* Real-time monitoring/protection
* Customer 2FA
* Monitor suspicious activities
* Security-oriented test sessions<p>Many of these are things you want to be doing ASAP. That doesn't mean they take priority over product/market fit, but it does mean you're not waiting for a milestone to build them. For instance: most competent teams have centralized logs. <i>Every</i> competent team restricts access to internal services (and IP restrictions aren't the way to do that). If you don't get this stuff started early, it's a nightmare to start later.<p>Other things on the list are things that mature, profitable companies don't bother doing, because the ROI isn't high enough. Customer 2FA is an example --- if you need it, you probably know. Real-time security monitoring tools are another big one; chances are, if you're reading a checklist like this, your monitoring needs are too idiosyncratic to buy COTS.<p>Post-Series-A is worse:<p>* CloudFormation
* Incident Response
* Internal security policy
* Asset inventory
* Bug bounty program
* Security audits
* SDLC<p>With the exception of bug bounties, which you might not bother ever doing at all, these are all ASAP items.<p>You could also start a list of important things they're missing:<p>* Security testing integrated into CI/CD pipeline
* Automated routine network monitoring
* Segmenting AWS accounts
* Having a process to tag PRs for security review
* Adding a security page to your website<p>This list reads to me like it was originally shrink wrapped around a product, and then expanded with bullets with links to random websites to throw the scent off.