Building a security program for a growing company

This series explains how a company builds a security program and keeps it working as it grows from a webshop to a supplier of public institutions. It follows ACME, a made-up energy monitoring company, through four stages, and at each stage it shows which security work is needed and who asks for it, with its cost. Each chapter is written in plain language, and most have a companion post for engineers.

Chapters so far:

• 1.1 Leading security at two startups in a row, both acquired about two years after I joined
• 1.2 ACME, the company this series follows
• 1.3 One set of security records for customers, auditors and regulators
• 1.4 Proactive, application and detective security in a growing company
• Threat modelling a data flow with STRIDE, for engineers
• 2.1 Keeping a WooCommerce webshop up to date and secure

The series index, with the chapters still to come: Building a security program for a growing company