of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com.
Library of Congress Cataloging-in-Publication Data is Available:
ISBN 978-1-119-70073-9 (Hardback)
ISBN 978-1-119-70074-6 (ePDF)
ISBN 978-1-119-70075-3 (ePub)
Cover Design: Wiley
Cover Image: © deepadesigns/Shutterstock
To my wife, daughter, and son, you have made reality better than the dream.
Foreword
“Connect”
I connected with Chris years ago. In classic Chris fashion: he shared a thoughtful cybersecurity insight on LinkedIn and our mutual friend connected the dots between us. While meeting him was great, little did I realize that simple connection was going to lead to years of friendship and learning.
Cybersecurity has been in such a constant state of flux that many companies still don't know how to write a chief information security officer (CISO) job description; they don't know what a CISO does in their day-to-day job. You will find CISOs as heads of IT, internal pentesters, security engineers, writing compliance reports, negotiating legal terms, reporting to any C-suite role, and some taking primarily customer-facing responsibilities.
There is little question that the security role is still in an early stage in its evolution. With all of that confusion, it is no wonder that resource-constrained start-ups and founders have no idea how to proactively build a security program. And with a start-up's demands to prioritize time, opportunity, and resources, it's no surprise to find start-ups with no security programs at all.
The reality is that as the world evolves and more business becomes increasingly digital, the security bar is rising for all vendors. Every customer that trusts a vendor with its resources (i.e., financials, customer data) wants to know that their sensitive information is being handled safely; something they know the bigger vendors are likely working on.
Luckily, start-ups are smaller targets for attackers and typically have much less legacy risk to accept. This results in high ROI, low-hanging fruit opportunities for start-ups, and large deltas in security preparedness between early stage start-ups. Coupled with the fast-paced, leading-edge value that a start-up can provide a customer, building security from the beginning is an exciting possibility.
Chris's dedication to learning and to helping the security ecosystem has been incredible to see over the years. This book is yet another example of his efforts to take his lessons learned as a CISO for different-sized companies and to help others. With this book, founders will begin to understand the necessary fundamentals of securing a start-up.
Meeting Chris years ago kicked off an awesome learning opportunity on the day-to-day dynamics of taking on a security leadership role at a fast-growing company. I'm likewise excited for readers to discover this book and to journey deeper into the world of security for start-ups.
Cheers,
Will Lin
Co-Founder & Partner
ForgePoint Capital
Cybersecurity VC
Preface
MOST BOOKS END WITH A QUOTE from a famous source; I am starting with one. In his book The 7 Habits of Highly Effective People, Stephen Covey states “The main thing is to keep the main thing the main thing.” This should apply to your start-up and how you should view every suggestion in this book. Every cybersecurity choice you make should, at the end of the day, be to enhance whatever it is you are building. From getting a better product out the door to high customer satisfaction from the services you provide. Don't lose sight.
There are a lot of topics covered in this book and cybersecurity taken as a whole can be overwhelming. That's why there is an entire industry built around it. As you read through this book, always keep in mind what is right for your start-up and your customers. You don't need to implement all the things we discuss in this book from day one or even by day one thousand. But you should understand the important trade-offs by the end of this book.
Just knowing those trade-offs then allows you to prioritize what is right for your start-up and allows you to keep the main thing the main thing. A great example is a security incident and event management (SIEM)1 solution, which is something you most likely won't need until after the validation phase, maybe even beyond the growth phase. I hope to provide you with the right know-how and understanding to intelligently make those decisions.
Of course, you are not in this alone. Your fellow founders, board members, venture capital (VC) advisory board, customers, peers, and vendors are all sources to validate your overall cybersecurity plan. Utilize the free resources that want to help and see your start-up succeed.
WHY WRITE THIS BOOK?
Cybersecurity is now a requirement for every company in the world, regardless of size or industry. Regulations and laws at the state, national, and international levels are being created at a faster rate. Constituents expect their elected officials to not only investigate the massive data breaches we've seen over the years, but also that those politicians do something about it. It is especially important for start-ups.
This book was written to be the go-to source for start-up founders, entrepreneurs, leaders, and individual contributors. There is no expectation for companies because of a lack of technical prowess or even experience as a cybersecurity professional. Accounting is an obvious part of all business, as is cybersecurity, and not everyone can be expected to be a certified public accountant (CPA) or an offensive security certified professional (OSCP).2
I will walk you through the sometimes chaotic and confusing world of working with cybersecurity professionals (and trying to be one yourself!), dealing with industry-specific regulations and the almost infinite supply of cybersecurity vendors.
I wrote this book because there are hundreds of books, studies, and white papers on cybersecurity and best practices but nothing speaking directly to founders and start-ups. There are even more books about start-ups and for entrepreneurs, yet not a single one mentions building your company in a secure way. The Kauffman Foundation estimated 530,000 new businesses were created every month in the United States during 2015,3 which translates to 530,000 new possible targets every month with no ability for them all to hire the experienced cybersecurity professional required to securely run a business today.
Many hiring reports indicate we are currently in a cybersecurity hiring crisis.4 However, that fact should not prevent any organization from developing
