Bootstrapping Security Programs: How to Gradually Implement an Enterprise-Level Security Program at a Fast-Growing Startup

Create a partnership with engineering. A strong partnership with engineering teams is critical to building a successful security program. Firstly, engineers who work on the product can point out known product design security gaps and opportunities for improvement. Secondly, engineering time and commitment are required to implement a secure software development lifecycle, address pen test findings and implement customer-facing security features. This not an easy task especially at a startup where engineering has to execute on the product roadmap quickly while under resource constraints. However, it can be done successfully by demonstrating that addressing security early in the deployment pipeline will ultimately save time. This is a great example of how security can accomplish its objectives via influence rather than control.

Leverage automation. Leveraging security automation from infrastructure security monitoring and auto-remediation through static and dynamic code analysis and vulnerability management is essential. Implementing automation where possible will make security an inherent part of each process and ultimately allow engineers to save time.

Open source investments There are a number of very good open source security tools; however, it is important to remember that while they do not require a license fee these tools require time to implement and configure, which is not free. With a small security team in place investing in tools that can be implemented and configured by the vendor is often a more effective approach.