A Founder's Guide on How to Secure Your Company Like a Unicorn | SaaStr Software Community

Alright. Hello everyone. I'm really happy to be here. I wish I could have seen everyone in person. But well, my name is Johanna. I work at a Swedish SaaS company called Detectify, where I'm building a community of ethical hackers and leveraging their knowledge to make the internet more secure. Secure. Today I will tell you more about how you should care about security beyond the basic things like firewalls, and really regardless of what size or stage you're in as a company, and maybe more importantly actually what you should do, what you should be doing right now to allow ethical hackers to help you with your security. Yeah, so this statement was said already 8 years back, I think, by an FBI director, slightly modified though. So he said there are two types of companies. There are those that have been hacked and those that will be hacked. I would like to modify this slightly and say that, you know, there are two types of companies. It's those that have been hacked and those that have been hacked but don't know about it. The thing is, hacking is not personal. It is often not targeted to one organization, and it is very often automated. So this means it doesn't really matter if you're a 10-person company, a startup, or like a SaaS unicorn. This is something you need to be thinking about either way. So as a SaaS company of any size, really, the question is you know, not whether this is an issue, it's rather how you choose to handle it. Detectify is founded on the basis that there will always be more knowledge about security outside your company than on the inside. There are few, few factors contributing to this. One of those is that security knowledge today is concentrated to a very few number of individuals. For example, there is a huge shortage of cybersecurity skill that is big already today, but also growing a lot. And what I also see is there are very few people on different hacking platforms that contribute with the absolute majority of the value. And given that the knowledge and the skill is concentrated to very few people, this really means that you won't be able to hire them all. The big unicorns maybe are the ones that can attract these people to hire them full-time, like maybe Spotify, Salesforce, Netflix. But even if they do, and even if you could, there will always be someone outside your company looking at you in a different way and thinking in a new and creative way that you have not considered before. So relying on internal knowledge will simply not be enough. So who are these people that sit on this knowledge? Well, so Detectify was founded by ethical hackers, and an ethical hacker is basically a person who enjoys the intellectual challenge of breaking something. You can think of it like, you know, a mechanical engineer who would enjoy, you know, picking an engine apart to really understand how it's built. The ethical in hacker here refers to, you know, doing this hacking with good intent and with no like malicious plans and actually doing it to help companies become safer. If you look at these people, they're typically also quite young. We have an example like Karim, for example, he hacked Spotify at the age of 13. Another reason for why you cannot necessarily hire all those people into your company directly. So at Detectify, these hackers are our allies. We work with hackers to channel the knowledge of the few and spread it to the masses. What I do is I build a hacker community. We have about 250 hackers right now, uh, we take in their knowledge, we automate their knowledge, and then we spread it to as many companies as possible. So this is based off the assumption that, you know, we leverage the knowledge of the few and then we can spread it to many companies to help them become safer. So this is, I mean, how we as a security company work with hackers, but what can you do? Not everyone works with security as their day-to-day thing and this is might not be your, you know, highest on your priority. So the first thing you need to do is to care about it at all, but the second thing I would urge you to do is to open up for the hackers and let them help you. Let the good hackers help you and let them in. And this is 3 concrete tips on how you can go about doing that. Some of these tips being extremely, actually, easy and not costing very much to do. Something that you should basically be doing right now. The first thing I would like you to do is to do the bare minimum. The bare minimum in this case is to have a responsible disclosure. And a responsible disclosure means you give the hacker an opportunity to report bugs to you without being afraid of the legal consequences. What happens is when a hacker inevitably finds something on your website and they don't have malicious intent with finding that, they will look for a way to contact you. They will also look for an approval to do so or like an indication that you kind of welcome that information. If they can't find any contact specific to this or any explicit approval, they might not say anything to you. Or even worse, they might spread the information to the public because they consider it important for the public to know about this vulnerability. In a report, for example, made by HackerOne, which is one of the big hacker platforms, over 60% of hackers say that they have found vulnerabilities but left them unreported because they have either not found anywhere to send it or they've been afraid of the legal consequences. So what is it that you should do? Well, you should give them a way to report it. 3 things: you give them some guidelines including at least the scope, so what on your website are they allowed to touch and what do they need to stay away from. Secondly, you give them a channel to report vulnerabilities through. It's as simple as an email address, usually security@company.com or like disclosure@company.com, for example. Third thing, you give them, you could give them a safe harbor. So you say, if you report things to us according to these guidelines in good faith, you will not be unduly penalized for it. Doing this will allow hackers to send things to you, and it's really minimum effort. It's basically creating an email and a security.txt part of your website. It can give you a lot, but it costs little to nothing. Hackers don't expect that much back necessarily, so you can, for example, put their name in a leaderboard or hall of fame Two examples here of GitHub and Google doing this. And these companies also pay out money for when a hacker finds bugs, but you don't have to do that. You can simply give them recognition, a thank you, something like that, as a token of appreciation. The second thing I would like you to do is to think like a hacker and automate your security. The fact is that we are all here building our products off the same technologies and in many cases actually the same code. I mean, Stack Overflow. So only looking at Detectify's customer base, we see thousands of customer assets using the same technologies. And hackers will naturally try to test and break the security of those technologies. So this means that there are widely applicable bugs in technologies that affects all of us. These bugs can seem harmless in isolation, but they can actually do a lot of damage. For example, look at one of the biggest hacks in modern times, or in recent times, Equifax, where 150 million Americans, their personal information was exposed. This hack was based on, on a remote code execution in Apache Struts, so a commonly used system. This bug had been known and fixed by Apache for several months. And this is not unusual, I would say, because, and for this reason, you know, hackers, they love to automate stuff. They don't necessarily, like, if you're not a government or tech giant, they're not gonna target you specifically, or they might, but likely, you know, less likely. More often than not, they build their attacks on old vulnerabilities in common technologies that have been known for, you know, a while, or it could be months or sometimes years. Some malicious hackers look specifically for fixes of bugs coming out in common systems and kind of scrape the internet and look for companies that use these systems but haven't updated yet, that are then vulnerable. Also, automation will help you, you know, with your development process. Because how Teams works today, I mean, constantly deploying new code every day, you need to keep the speed up. So you need to continuously test your code as it comes out. And I know speed is one of the most important things for everyone in this virtual room. So automating will help you to be secure, but maintaining your speed of building your products. If you, for example, use a web vulnerability scanner with active exploits, you would be able to know when you're affected by these types of vulnerabilities. The third thing you can do is to not just wait around for the good ones to hack you before the bad ones do, but to actually incentivize ethical hackers to hack you more creatively. That could be through giveaways like stickers, t-shirts, swag and stuff, but also of course money. So you can pay out money for different levels of bugs, everything from $50 to actually higher than this. I've seen $30,000, $60,000 for certain very specific vulnerabilities. But this is not something you should do unless you have the basics in place. So have you automated and eliminated the widely applicable bugs? Do you have the capacity to respond quickly to hackers reporting to you? And do you have the capacity to fix things in a reasonable time? So this is something that I would do as a future step and that almost all of the tech unicorns are working with. So if I want you to live with one thing today, well, it's don't be the company that are being hacked but doesn't know about it. At the very least, make sure you have a responsible disclosure policy and that you have the door open to the hackers. Make sure you automate away the widely applicable bugs or the coding errors that we all do. To have a vulnerability is not necessarily the end of the world, but to have a vulnerability and no way to report it is really bad. So hackers are your allies too. Invite them, leverage their knowledge, and let's bring safer products to market together. Thank you.