TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Security 101 for SaaS startups

105 点作者 dpaluy大约 8 年前

12 条评论

cyberferret大约 8 年前
A pretty useful, logical and sensible list. I&#x27;d be actually surprised if most SaaS startups were NOT doing this. As a one man show (recently doubled in size to TWO!), I&#x27;ve ticked off nearly everything on here.<p>One question though - is on the multiple domains bit. Not sure how several separate domains is better than one domain utilising subdomains for API etc.? Intrigued about the &#x27;secret&#x27; internal domain thing, and I guess it would apply to larger organisations.<p>I&#x27;d be interested to hear how many startup founders here have a separate internal domain name for back office stuff related to their web offerings.
nkkollaw大约 8 年前
Might not contribute much to the discussion, but I found this pretty sad:<p>- Mac users can encrypt their drive with 1 click.<p>- Windows users would need the Pro version and prefer laptop hardware that supports TPM.<p>- Linux users would require disk reformatting
评论 #13816276 未加载
simplehuman大约 8 年前
Good advice but this is a little dubious &quot;For other internal communication use Slack&quot;. Use slack because it is beautiful and free, not because of security
评论 #13799295 未加载
评论 #13798909 未加载
wink大约 8 年前
A few remarks&#x2F;questions<p>&gt; Stop using disk-on-keys<p>never heard that phrase<p>&gt; Buy at least 2 or 3 domain names<p>I don&#x27;t really understand the whole paragraph - or fundamentally disagree with your reasoning. Of course there are some upsides (regarding security) of splitting stuff over a few domains but there&#x27;s a lot of reason why you wouldn&#x27;t do that. I think this is written too harshly as &quot;Do as I say&quot; without <i>proper</i> explanations and nuances of the details.<p>&gt; Monitor your endpoint&#x27;s public certificate expiration date, to detect prevent certificate expiration.<p>typo? missing &quot;and&quot;? remove &quot;detect&quot;?<p>&gt; By default AWS users choose Oregon (us-west-2).<p>Highly misleading. Or is your advice only relevant for US companies? I&#x27;d also say this is false for many people who have an international market leaning towards Europe, not Asia - then us-east is often better.<p>&gt; Using git would allow you to add outsource&#x2F;freelance developers for a limited time, by giving and then revoking commit permissions.<p>Non-sequitur unless you insert &quot;easily&quot;. Maybe. I don&#x27;t disagree that git is the way to go, but your reasoning is nonsensical here. We did exactly that with CVS and SVN 15 years ago.<p>&gt; Every service you use requires a 2nd authentication factor (2FA).<p>This is under &quot;your first customer&quot;. Was this meant to be &quot;should require&quot;? Are you talking about the XaaS you (the company) are using? Are you advocating that your users use 2FA with your product?<p>&gt; Antivirus<p>No, don&#x27;t.<p>All in all some good points, but could use some clean up. You&#x27;re lumping things together from varying degrees of technical expertise - also some paragraphs are highly detailed (and thus, sometimes miss to convey the bigger point) and others are pretty sparse.<p>Sorry if this sounded like complaining, there were (very) few points where I strongly disagree, but overall a good overview. I probably would&#x27;ve split it in at least 2 parts - e.g. for a CEO (overviews, less details, but more fields) and CTO level (technical stuff, with details).
评论 #13800655 未加载
_wmd大约 8 年前
SPF and DKIM can be applied just fine to subdomains, I don&#x27;t understand the suggestions made for email, yet there are good reasons to have a few extra domains, none which are actually mentioned: accidental cookie leakage and redundancy being obvious ones. The implication made for the API domain was that it should not be protected by SPF and DKIM<p>I stopped reading there
评论 #13800670 未加载
评论 #13839863 未加载
评论 #13800671 未加载
joshvm大约 8 年前
I would advise against Google Drive for document sharing. Recently I tried to share a trial build of an application (an exe I built) with a client. I zipped everything up and created a share link. Google auto-flagged it as a terms of service violation and blocked the file. No way of getting round it, and no way Google will bother to remedy the situation in time.<p>There&#x27;s also OneDrive for business which seems to work well for sharing, though syncing options are totally broken. There&#x27;s no way to selectively sync a share folder, so either you have your entire filesystem downloaded or you go online to get files. That sucks when your backup is terabytes of data.<p>I ended up sending a Dropbox link instead. So far it seems to be more or less foolproof.
评论 #13800745 未加载
ecesena大约 8 年前
&gt; automation (for example a Jenkins task)<p>I think there&#x27;s value in this, but I want to point out that often time Jenkins becomes a collector of tech&#x2F;security debt itself. It has very high privileges, and often time accesses&#x2F;changes are not properly auth &amp; audited.
评论 #13800749 未加载
mugsie大约 8 年前
If any developer says code review is too &quot;corporate&quot;, I would suggest that they need to try a different profession.<p>Code review is an industry practice these days, and that is a good thing. I would say even for POC &#x2F; MVP development, CR is a must.
评论 #13799111 未加载
itaifrenkel大约 8 年前
Original Author here. If you have questions or comments I would love hearing them.
评论 #13799476 未加载
评论 #13798425 未加载
tarr11大约 8 年前
Disabling email attachments from your email server is also a good idea.
评论 #13798899 未加载
koolba大约 8 年前
&gt; Open an email group and name it seurity@mycompany.com and add a page on your website to report security incidents to this email<p>You know a company takes security seriously when they have a typo in the word &quot;security&quot;.
评论 #13798333 未加载
评论 #13798345 未加载
评论 #13798328 未加载
Puts大约 8 年前
&gt; Remember that SSL encrypts network traffic, but does not supply authentication. SSL is also not a replacement for 2FA.<p>False and false.
评论 #13799370 未加载