Security for Startups

In general, startups are lean, fast, data-driven, and forward-thinking. This makes them prime users of cutting-edge tools, big data, and cloud-based technology. However, security is critical in these fast-paced, high-stakes environments. Regardless of workload, startups can’t afford to let security fall to the wayside. 

Further, as the business standard moves from on-prem to the cloud and from the office to a work-from-anywhere model, startups need to pay special attention to their remote and hybrid-remote security. That’s a lot for a startup to manage. 

With the right security, tools, and practices in place, startups can fuel faster, more effective growth and position themselves for smooth scaling.

This e-book will cover the essentials for security with recommendations tailored specifically for startups. This includes solutions to the challenges most startups face today, remote and hybrid-remote security factors, employee and device management, and cloud infrastructure and application management. We’ve also included a synthesized checklist to act as a quick reference guide to jumpstarting your security.

Startup Security Challenges

Office Environment Challenges

Personnel Awareness

Awareness of an employee’s surroundings is critical. While a startup’s office may be small or may be a shared space, knowing who should be in the office is important. Hackers will often try the old technique of masquerading as an employee or a visitor, so if a stranger is in the office, employees should know to ask them if they are in the office to meet someone. Be sure to include personnel awareness in your security awareness training.

Control and Monitor Physical Access

Many offices have some sort of physical access control, either through a key, fob, or card access system. Consider investing in a digital solution with regular logging of who enters and exits to track unsolicited visitors, as in the in-person social engineering tactics described above. Video cameras are also advisable to monitor your equipment and materials – some cameras are intelligent and network-connected so they can alert you to after-hours activity and save footage in the cloud.

Internet Connection Security

The internet connection in your office needs to be secure. There should be, at a minimum, a next-generation firewall at the connection that blocks malicious traffic. Investing in more security like content filtering or intrusion detection technology is a great improvement, but a strong firewall is a must.

Wi-Fi Security

Wi-Fi security should not just be an SSID and passphrase. That level of security is simply too easy to compromise.

Each user should have unique access to the Wi-Fi network through an authentication system like RADIUS, which authenticates each user individually. RADIUS eliminates the problems that shared network credentials pose (like writing the Wi-Fi password on the office whiteboard).

Ideally, RADIUS should integrate with the user directory to streamline user data and maintain one central repository system.

For an additional layer of protection, create a separate guest VLAN with restricted access to ensure security while providing a positive user experience.

On-Prem Infrastructure

Just as you would only assign administrative privileges to a select few people, you should keep the server room just as tightly restricted and monitored. If your organization still has on-prem servers, keep them locked up, only grant access to people who need it, and keep track of those who have access.

Securing Cloud Infrastructure and Applications

Securing Your Applications

User Access

Controlling user access to applications and effective user lifecycle management are some of the most important aspects of security in a growing startup. The modern organization now stores its critical data in several different locations: for example, a startup might store its source code in GitHub, customer data in Salesforce, and financials in Xero. In an environment where the crown jewels are stored in disparate locations, organizations need to be extremely restrictive and diligent about who they grant application access to. 

Connecting user access to your core directory service can make the user lifecycle management process much simpler and more secure. Look for a directory service that can attribute roles to each user and intelligently provision application access and security policies based on that user data. Context also matters, and innovative organizations are leveraging conditional access techniques to ensure that access to critical web applications is verified and secure based on identity, device, network, and least privilege access.

Shared Access

Shared access is a common issue in startups. Often, this occurs in an attempt to save on licensing costs or as the result of shadow IT; to move quickly and efficiently, employees at startups sometimes leverage solutions without involving IT (or they may not have a designated IT department to regulate application use). However, the cost or time-saving benefits don’t outweigh the risk of sharing credentials. 

Aside from the obvious problems with sharing passwords, it also makes tracking who has access to the credentials nearly impossible. Organizations should never cut corners by skimping on licensing or allowing users to share accounts with one another – especially when it comes to access to cloud infrastructure or web applications.

Multi-Factor Authentication

Despite a widespread understanding of the importance of password best practices, many users still do not follow them. This, coupled with hackers’ increasing sophistication in password cracking, drives a need for a more sophisticated login solution than a password alone. 

MFA alleviates the problems with passwords; whenever possible, MFA should be turned on. This exponentially increases security by requiring access to both credentials and a user’s proprietary device at the same time. 

Many systems and applications have the option to enable MFA; for those that don’t, single sign-on solutions can apply MFA to all of a user’s applications with one secure login.

Eliminate Old Accounts

Retaining unused and unattended accounts is one of the top ways organizations are compromised; in fact, 48% of people retain access to at least some of their former organization’s IT resources. This presents both security and compliance risks. 

Cloud directory platforms drastically reduce the risk of leaving accounts open unattended through fast, integrated offboarding: when one IdP manages all of a user’s applications, you can deprovision them all at once. Reporting and analytics solutions can also highlight old accounts that are on systems that need to be removed.

Securing Employees and Devices

Securing Devices

Device Responsibility

While all work devices should have strong controls and be encrypted, this should not be the only method of defense. Employees must understand that they are responsible for keeping physical control over the devices they use for work, whether personal or corporate-issued. Adding this layer of diligent control and protection by the employee further secures corporate data.

Device Encryption

The latest operating systems offer full-disk encryption to help protect the data located on endpoints. Because it is highly likely that corporate data can be found on endpoints despite using cloud services, device encryption is an important step to take in protecting valuable corporate data. 

Disk encryption is relatively simple to enable, and it is also user-friendly. The password to the device can toggle the disk encryption on or off, which underscores the importance of a complex password. A centralized approach will ensure that recovery keys are safely stored as well as reporting on what users/machines have disk encryption enabled and those that don’t.

Multi-Factor Authentication

In addition to using MFA for systems and applications, employees should enable MFA on their devices. A complex password adds to the security of the endpoint, but adding MFA access to the endpoint raises it to another level. Conditional access can reduce the friction of this step when a user signs on using other known criteria, like on an approved network.

Antivirus/Anti-Malware

Antivirus (AV) software should be installed on every device. There’s a reason that this security protocol has been an IT staple for many years. While AV software does not catch every issue, it does dramatically decrease the chances of an endpoint being compromised. Again, layered security is always better than a uni-dimensional approach, and antivirus/anti-malware is an effective frictionless layer.

Lead with Documentation and Training

To cultivate a security-oriented company culture, startups need to create a security program that specifies their security standards and policies. They must also issue mandatory training to ensure employees understand these policies. 

The security program doesn’t need to be a complex or long document; in fact, a clear, concise program for your employees is likely to work much better than a long list of items that they need to do or be aware of. The right security program gets your employees thinking about how they protect their personal data, accounts, and access because they understand the significance.

Devices and Equipment

Security Best Practices