41:02This recording is not available yet.
Security from day 1: Lessons, tools and tips from the land of the greenfield
Download resourcesCategories
Application SecurityDevSecOpsGovernance, Risk & LeadershipCompliance & RegulationSecurity Program & StrategyOT, IoT & Critical Infrastructure
Vendors and tools discussed
About this session
Guillaume Ross, then chief security officer at a Canadian banking-as-a-service startup, explains how to use a greenfield to build security that also makes people more productive, all within a company's first weeks. He starts with priorities: in a startup, friction kills, so controls must be automated and the aim is to take on only the good kind of technical debt, documented. He then walks the stack in order: lock the domain registrar with two-factor and a dedicated mailbox, buy the collaboration-suite tier with real security features, enforce two-factor while disabling SMS and self-service recovery, hand out hardware keys, block third-party OAuth apps by default, configure DKIM and DMARC on day one, drop-ship laptops through Apple DEP or Windows Autopilot into an MDM, and gate access with conditional access instead of a full-tunnel VPN. For engineering: SSO-backed GitHub, branch protection, CODEOWNERS files, repositories created only through Terraform, static analysis that blocks merges, infrastructure and permissions as code, egress filtering and mutual TLS. He ends with tagging every task by the compliance requirement it satisfies and using open-source policy templates.
Many of us have wished to start from scratch when trying to implement security in an organization. For some of us, it can become a reality through working for a new
company or project, but the reality is, nothing is ever a true green field. Partners, compliance, vendors, getting to market and conflicting priorities can make it sound difficult to implement security in a brand new startup, but it is
possible. In this talk, you will learn how you can implement a security program as early as possible in the life of a startup, by taking advantage of some of the benefits that come with being small and agile, as well as having tools that are easier to configure than most "enterprise" solutions and focusing
on a cloud-first architecture.
Key takeaways
- Secure the domain registrar first: two-factor on the registrar and its mailbox, then move the domain to a properly managed provider once the transfer lock expires.
- In the collaboration suite, enforce two-factor with SMS and voice disabled, a 24-48 hour enrolment window, no self-service password recovery, and hardware security keys for admins at minimum.
- Block third-party OAuth apps against mail and drive by default and allow-list after a light review; cleaning up thousands of forgotten apps later is far harder.
- Ship laptops through Apple DEP or Windows Autopilot into an MDM that enforces disk encryption, firewall and auto-updates, then use conditional access to block non-compliant devices instead of a full-tunnel VPN.
- Make policy executable: create GitHub repos only through Terraform, protect branches, route exception files to the security team via CODEOWNERS, and tag each control with the compliance requirement it satisfies.
Speakers
Guillaume Ross
Guillaume has been working in IT and security for way too long by now. Having built security programs for companies of all sizes, worked in vendor organizations on the security and product management side and through years of consulting, he likes to… Read moreRead less
Guillaume has been working in IT and security for way too long by now. Having built security programs for companies of all sizes, worked in vendor organizations on the security and product management side and through years of consulting, he likes to keep it fresh by alternating between working internally, securing companies, and working for companies in the security industry. As the Head of Security for a brand new Fintech startup, he is currently learning a lot about managing security in an agile environment where security is an extremely high priority. Guillaume is a frequent conference speaker, alternating between technical/blue-team topics as well as security management topics. Guillaume is also a Pluralsight trainer, producing cyber security training around topics such as network security monitoring, SOC operations, osquery, cloud security and more.
