A thing some of your peers actually believe could happen

“Understaffed startup attributes shipping on time releases and steady feature improvements without death-marches, attrition, an FTC injunction, a data breach, or revenue impact to weeks spent implementing:

• an HSM.
• a certificate authority tied to the HSM.
• transport encryption (correctly).
• browser based bcrypt(scrypt(PBKDF2())) password storage.
• a honeynet.
• data classification, retention, and encryption.
• CAPTCHAs.
• secondary questions.
• out of band credential reset via e-mail and SMS.
• authentication rate limiting.
• two factor authentication.
• the latest browser-supported frame-busting, XSS, and CSRF mitigating security controls.
• a custom security library.
• vulnerability management.
• administrative roll based access.
• proper logging.
• log monitoring.
• fraud monitoring.
• BGP peering DDoS appliances.
• a web application firewall.
• an intrusion detection system.
• Sender Policy Framework.
• A separate top level domain for every system.
• developer training in:application security, security architecture, cryptography, ecrime, computer and network forensics, and incident response.
• security through obscurity (no NOT security through obscurity!) ((what does that even mean?)) (((well it rhymes!)))
• a vulnerability disclosure bounty program.
• an FTC injunction.
• a SOX, HIPPA, PCI-DSS compliance program.
• server file integrity monitoring.
• and the free pizza lunches the founders provided daily.

March 4th, 2013 9:32am