Building a security program for a growing company
A series on building, running and improving a security program, following one company from webshop to public sector supplier, for founders and engineers.
Series
Building a security program for a growing company
A series on building, running and improving a security program, following one company from webshop to public sector supplier, for founders and engineers. The full chapters are on keibisoft.com: https://keibisoft.com/blog/security-program.html
Posts in this series
Leading security at two startups in a row, both acquired about two years after I joined
I joined Krizo at 24 and became its acting CISO, then led security at Omnio. Dataminr and IBM acquired them about two years after I joined.
ACME, the company this series follows
ACME, the small example company in the series: how it grows from a webshop to the public sector, who cares about security at each stage, and which rules reach it.
One set of security records for customers, auditors and regulators
Customers, ISO 27001 and SOC 2 auditors, NIS2 customers, GDPR, the Cyber Resilience Act and buyers ask for the same security records, shown with two examples.
Proactive, application and detective security in a growing company
Proactive, application and detective security, placed on one company's data flow, with the first steps of each kind at each stage of its growth.
Threat modelling a data flow with STRIDE
Draw the data flow in OWASP Threat Dragon, then go through each element and flow with STRIDE: the boundary, the data, each threat and its control.