Cloud Security for SaaS Startups Part 1: Requirements for Early Stages of a Startup

Based on the Cloud Security for Startups guidelines written by the CSA Israel Chapter

Background Information security is a complicated subject even for mature enterprises, so it’s no wonder that startups find the area challenging. Planning, implementing and maintaining good-practice security are not only necessary, but can also serve as an important advantage that can be leveraged as a marketing differentiator.

A common challenge for Software-as-a-Service (SaaS) Startups is gaining and maintaining customers’ trust. To help address this challenge, the CSA Israel Chapter created guidelines to help SaaS organizations meet the most important security and privacy requirements presented by customers considering new services and products.

In this blog we provide a preview of the information and guidelines available in the full Cloud Security for Startups paper. In part one of this series we will cover:

• Security requirements for early stages of a startup
• Why you should pay attention to security early in the game
• What to consider when choosing a cloud platform

Who should read this blog?

• Cloud-based startups who wish to understand their security roadmap.
• Founders, CTOs, product managers and architects.

Security Requirements for Early Stages of a Startup

Startups must plan their security posture according to the progress they make in funding and product development. To help startups evaluate necessary security requirements, we have outlined three phases of SaaS startups maturity:

Phase 1: Inception. From idea to first customers. In the phase between idea and the first customer, budget generally is limited, so startups should focus on laying building blocks for future potential security needs.

Phase 2: Prepare for Growth. When the startup has paying customers.

Phase 3: Maturity. When a startup has gained a strong, positive reputation and enough customers to create profit, it is time to advance to a more mature security posture.

When examining which security controls should be implemented for each phase, there is a difference between market sectors and the type of data your startups collect. As a general rule, if startup characteristics match any of the following, the company should prepare to move faster through phases of maturity discussed above.

• If a startup’s target customers have become enterprises, the company can expect to be questioned about participation in the shared responsibility model, identity management and security policies.
• If the data a startup stores contains high volumes of PII or sensitive PII (e.g. health information or financial details).
• If a startup must comply with especially strict regulations and laws (e.g. HIPAA, GDPR, Privacy Act).
• If a startup’s target sectors include representatives from the industries of health, government, financial or homeland security, the startup must then expect industry-specific regulations and additional security needs regarding its location of services.

Tip: The Cloud Security Alliance Cloud Controls Matrix (CCM) is an excellent tool for mapping the security requirements of various laws, regulations and standards, and for better understanding future challenges.

Why Pay Attention to Security Early in the Game?

• Implementing security measures early on can help a startup gain customer trust and meet the compliance requirements that will come later.
• Some startup’s customers have internal IT security requirements that will need to be implemented by the startup.
• Inadequate attention to security risks early in the lifecycle of a startup may lead to “technical debt,” which may be too expensive to resolve later.
• Adequate attention to IT security needs—especially to the startup’s intellectual property (IP)—can significantly influence the startup’s valuation and reduce risk to investors

Choosing a Cloud Platform

There are many parameters to consider when choosing an IaaS/PaaS provider. Many of these parameters are not directly related to cloud security, but the following are directly implicated.

• Service location. When targeting enterprises from a specific geographic jurisdiction, it is recommended to keep customers’ data in the same geographic location. Doing so can relieve compliance efforts and create a competitive advantage.
• Regulations. SaaS startups should strive to work with service providers who adhere to the same regulation regime and standards as their designated market.
• Ecosystem. A SaaS startups usually strives to consume external software and services in order to reduce development hours. A large ecosystem of knowledge, tools and third-party software is an advantage for cloud providers.

Tips

• When targeting enterprises in the US, EU and/or APAC, consider deploying data storage into all of these regions to meet compliance.
• IaaS will provide better flexibility and control than PaaS, if you own your server’s configuration. However, choosing a PaaS provider also establishes a responsibility to secure those servers.

Interested in learning more? Download the Cloud Security for Startups guidelines to learn more recommendations for improving security as a SaaS company.

Acknowledgments

The content for this blog was created by the Israeli chapter of the Cloud Security Alliance (CSA). The Israeli chapter of the Cloud Security Alliance was founded by security professionals united in a desire to promote responsible cloud adoption in the Israeli market and and deliver useful knowledge and global best practices to the Israeli innovation scene.

Creators

• Moshe Ferber
• Shahar Geiger Maor
• Yael Nishry
• Contributors
• Marius Aharonovich
• Ron Peled
• Yuval Reut
• Ofer Smadari
• Omer Taran