What SaaS Data security, Risks & Compliances Are | With Security Professional Darren Gallop

So for those who are in our audience or maybe, you know, early stages or they don't clearly understand, you know, this space, can you explain what, you know, SaaS data security is, the risk and compliances are, why is it important, why should SaaS founders make sure that they get that right?

Yeah, so if it— to define what, you know, whether you call it data security or cybersecurity or information security, these are all terms that are thrown around. Now we have data privacy in there, which generally refers to privacy regulations. Essentially, the information security is basically anything that protects confidentiality, integrity, or availability of information. So Inherently, I think every startup, every CTO, every technical founder or developer has some sense of it to a degree. So, you know, you obviously know that you want to have backups because if something bad happens, you want to make sure that you still have availability, you still have your customers' data, and, and you're generally doing things to ensure uptime. I mean, it's obviously not a good look when your web app goes down for a day, especially if it's a critical service. Right. But really, you know, unfortunately, a lot of startups, you're generally thinking about figuring out what are you building, trying to build it quick. It's never quick enough. Everything takes like way more time and money every time. I've never seen people say, hey, we're going to build this thing in 2 weeks, or we're going to build this feature in a month and do it. It's very rare that it happens on time. So you run into snags, you got a lot of pressure. You know, obviously, as a startup, you're always working against the clock. So you're spending money trying to get your product to a point where you can validate it and have customers customers pay for it, either to generate money so you can pay your bills and your wages or to raise that next round of capital. So unfortunately, because of that pressure and all those other big projects that are looming on sort of your business succeeding or not, cybersecurity or data security generally doesn't have any formal sort of articulation. And the problem that creates is you end up writing more and more code. So if there's any bad practices that you have, or if you architect things without thinking of all the elements of security, The problem that happens when you're, say, at $2 million in ARR, and you're like, okay, well, we need to pass an audit, or we need to do this thing, is that you have all this technical debt you may not have even had real— really had an inventory of. So you have all of this sort of accumulative code and architectural decisions and product design decisions that, that could negatively affect you. And so, you know, I think traditionally, there wasn't a whole lot of pressure on startups. Like when I think about launching my first SaaS in 2010, Yeah. I very rarely got, you know, you got really weird questions like, you know, what's the cloud? Or like, what's this? People would say things like, what is security like? Without really knowing what they're talking about. That has changed so much. Like, if you're selling now to upper mid-market or to enterprise right now, like, it doesn't matter if you're a 2-person SaaS or 100-person SaaS, you are not going to be able to sell a product that touches any customer data of any level of confidentiality, like even simple things like names and phone numbers of their employees or addresses or stuff like that. I mean, you're just not going to be, they're going to want to go put you through a process, a third-party risk and due diligence process, where they're going to ask you a lot of really pointed questions. And I go through this with my customers all the time. Honestly, most of our customers come to us too late. They come to us when they're just at the verge of potentially losing that big deal that I've experienced. And they've waited too long, they've, they've, and they have that buildup of technical debt. So it's not like you can just flick a couple of switches and automatically have your company secure. And just to be more clear, you know, there's, there's in most startups, there's a couple of key components, like obviously your SaaS is predominantly your largest and most valuable asset. That's usually where most of your customer data resides. So that is a big piece, obviously, of any security or compliance exercise. But you also have requirements like background checking of employees, you need to make sure that the laptops are secure, that there's some sort of endpoint protection, you need to make sure there's training and awareness, and there's written documents, and there's there's a process and there's very clear articulation of the importance of security in the organisation. So yeah, it does take some work, but the sooner you do it, the earlier in your business you do it, the less work it is. If it's something that's thought of from day one and is just incorporated, even not as a predominant thing, but just as a thing. So you have some, you know, you have a couple of lunch and learns, you focus on secure development practices, and you're thinking about security by design in your application. And just sort developing those, those good practices right from the beginning, then when you have that big proof of concept with your ideal customer, you're going to look sophisticated and responsible. You're not going to be caught in that. Like, I see so many founders being caught not even understanding half of the questions that the vendor's asking them around their data security.

Sure, sure. So you mentioned that most of them will come to you probably at a point where it might be just a little bit too late than you'd like, or just makes a lot more complicated at that point. At what point do you suggest that a SaaS company or founder Really start thinking about that cybersecurity and data privacy? Is that from still day one, or, you know, once you have that client?

Absolutely. I think it makes— I make— it makes sense to do it at day one. If you are doing it because when the customer's on the door, um, you're in a bad spot. And the re— I think about it like you've got this communication going on where you're back and forth, your sales team, everything's quick, you're being responsive, you're doing all the best stuff. Then they send you a security questionnaire, and now it takes you 2 weeks to respond. Like, it's very clear to that auditor that your delay in responding is an indication of the fact that you're looking at this going, oh.

Yeah, I didn't think about that.

So you don't want to wait until you have to do it. Believe me that you will have to do it. And I think when we started working in cyberspace or looking at it, it was mostly like health tech, fintech areas where there's a higher degree of, you know, critical or very protected information, confidential information. Now it's really anything, and all these privacy laws like GDPR, the General Data Protection Regulation in Europe, CCPA in California, PIPEDA in Canada, and there's others coming down the pipeline as well. They're all influencing that as well, and they're creating— they're forcing large organizations to reevaluate their entire data program, and of course to look at their— they have to look at their vendors because if they're using a SaaS vendor, they need to make sure that that vendor is not taking out of compliance or not introducing new risks to the—

Right. What are some typical breaches that you see, you know, from common, common around SaaS companies? Yeah, just what are you seeing there?

So, you know, there's, there's, there's always the case that the lower profile you are, which generally as an early stage company, you're much more low profile. Generally, when, when you're very low profile, there's, there's less targeted hits towards your organization. As you start increasing your profile, as you market yourself and your brand, while you're marketing that to your customers, you're also marketing that to hackers. So as you start being noisier, there's more likelihood that you're going to have more sophisticated or more targeted attacks, or if you start selling or landing deals with, with very reputable and noisy customers. So in our case at Mercato, I mean, we had, you know, we had Coachella logos and Burning Man logos on our website, so So, you know, if you were really trying to take down Coachella, you would look at who are their vendors, right? So that really, you know, points to your company in that regard. But, you know, the most common things that we see in early-stage companies, basically generic attacks where people are just circling around looking for vulnerabilities in websites using a bot of some sort. They find that your website or your server is using an old version of TLS or something like that, that they can— that there's a, you know, an attack vector they can, they can take advantage of to gain access, or they do input validation testing and your tool fails, or your web app fails that, they go and they do some sort of hack where maybe they get the whole database. And a lot of times, most of the time, startups don't know when this happens, because what'll happen is it gets released in the dark, in the dark web down the road. And it's usually in a combination of multiple hacks. So they may hack like 1,000 companies or 100 companies, and then pull that together as a big dataset and then sell that dataset in the dark web.

Wow.

So it's not like like you're gonna find it 'cause somebody's like, hey, Securitas data is for sale on the dark web. It'll be some random name by some random hacker that's available. And, you know, if you don't have the monitoring tools, you're not doing any sort of threat monitoring or dark web monitoring, you may never find out that you've been hacked. So I would, you know, take a guess that there's a lot of companies out there that have been hacked that don't know it. And then, you know, the other ones, the ones that we see people feel the most as early stage, denial of service, so dedicated denial of service, DDoS attacks happen often enough. There are tools out there that you can put in place that reduce that, the likelihood of that. But to be totally honest, the thing I see the most often is internal error is the largest compromise and most— largest known compromise that I see in SaaS companies. So that is lack of proper code testing or quality of service before code is shipped to master. And so you have a developer who's really tired, and out a deadline at the end of the day for a customer and they push a piece of code and then they're out the door, they head out for beer, and then all of a sudden phones start going off because now, you know, CPU is crashing or overloading because there was some random piece of code that, because there wasn't proper testing in play or they were cutting corners in that regard, now this thing's taken the web app down. So you're doing your own denial of service internally by a developer, overtired developer error. Or, you know, another one that I've seen is cases where the proper checks and balances aren't being had, and there's not enough sort of test-driven code in your code base, and somebody deploys something that actually allows for privilege escalation. So maybe somebody who's not supposed to have access to financial information in your organization and your CRM now has access to that.

Right.

Or, you know, a customer is able to see something they're not supposed to see. So we see a lot of that, and that can be very embarrassing and problematic, can even cause legal, you know, legal outcomes. But we end up investigating a lot of scenarios with SaaS companies, especially young SaaS companies that don't have those practices in place.

Right. Yeah, that's crazy. I never thought of that, like people stealing your database and then selling it on the dark web, and as you wouldn't find out until you see maybe a copycat show up with the exact same code. That'd be crazy.

But again, like, I think, you know, I think the most important thing is that whether you think you're susceptible to being hacked or not, It's still— if you think you're not going to be hacked and you think you're secure enough, but you still don't have a formal security program, that's not going to be enough to satisfy most customers nowadays. So if you're not concerned about your low profile and the chance of being hacked per se, you should certainly be concerned about how problematic it's going to be in your sales process very early on.

Got it.