Legit question for tech department leaders. Our engineers have good solid knowledge on the security todo lists and does/don't. I saw the natural order of things where MVPs or quickly developed tools had to be refactored /redesigned to be more secure or at least up to standard. That's OK. However we are as strong as our weakest link.
As we scaled, each department (also non-tech) slowly started being more proactive, mini tools developed by managers, or leaders, e.g CRM workflows, random scripts, docs, sheets, and now vibe coded tools. All of these are now potential attack vectors. We add to this:
- Non-tech folks in the company, you impose rules, password managers and rotations, but you always have a small percentage of bad actors. - External users not putting good passwords, or using pwned passwords never changing them - Some product decisions or weaknesses built on purpose to facilitate usage of the tools (which goes against perfect security).
In our case it caused us being a target, we are under attack most of the time. We secured our tools under WAF with standard approaches (rate limits, blocking IPs, bot detection), but it feels like there's always a flaw/leak somewhere to fix.
With LLMs attacks are becoming more and more interesting, harder and hard to prevent or detect. We have a proper dev team, good at maintaining the codebase and libraries. You can imagine our mindset shifting from "full feature dev + good maintenance" to "some feature dev, a shit ton of security monitoring".
Our users are not tech savvy. Things like passkeys are sadly out of the question. Even MFA seemed out of reach at some point. Some of them sadly get phished from time to time, it angers us. We want to do more but it feels impossible.
Is there anything you guys did that helped? other than just securing and making it harder for attackers?
1. The security of your product, aka Product Security (you mentioned "users", MFA, the dev team, etc...) 2. The security of your internal company networks, endpoints, etc used by employees and systems to operate the business, often called Information Security (you mentioned "non-tech folks in the company", pwned passwords etc...
The biggest thing that comes to mind that you've not mentioned here is security training for both the Information Security side of things (e.g. all employees), and the software developers (technical training about the various vulnerabilities, secure coding best practices, supply chain attacks and how to mitigate them, etc...). I used to teach security training courses for past employers to software engineers and other colleagues, and we did see improvement from those who were trained. Many organizations will have that 1-2 people who just won't cooperate, listen, or play dumb and unfortunately click that link, or do something untoward that puts the whole org at risk, but this sort of thing can also be partially mitigated by proper network segmentation and in the case of product security, proper security controls in the CI/CD and build & release pipelines, amongst other things. Unfortunately, there is no way to achieve "perfect security" and I've found that as a business grows and brings more people into the mix, the likelihood of something getting lost in translation and going unnoticed grows as well.
Another big point - You can't secure what you don't know about. The first thing a pentester will do is scan your entire domains and pages for other domains and pages, and we will build a big list... So for example if you have employeehub.yourcompany.com, I'm going to scan and dig up like 50 other subdomains, and if I find dev1.employeehub.yourcompany.com, I'm going to go there and see what's exposed to the public... Maybe your team forgot that was left up and exposed, and maybe since it was supposed to be a temporary or a test endpoint, it has less security features than employeehub.yourcompany.com does and it may be a way in, etc... So, a pentesting firm will provide you with all of this recon information about your site in addition to trying to actively find and exploit vulnerabilities on it. Certain security companies also offer whats called "Attack Surface Management" which is software that helps you to identify your assets and the attack surface as well... Those are often quite large dashboards with many options, but as a pentester, I can get a list of practically your entire attack surface in a matter of seconds using some of my tools. The point is, you have to inventory everything you expose externally, internally, and in your products. Your products and dependencies should also have SBOMs and vulnerable dependencies should be patched, etc... I don't know the size of your business, you may not need a CISO, but at least one proficient engineer who can handle much of this depending on the size.