Let’s assume your budget for cybersecurity is $6,000 instead of $600,000,000. And let’s assume that you are responsible for collecting and securing PII (including SSNs), need to move money on behalf of your customers, and need to assure investors and partners that you have a robust security and compliance program. Where do you start? How on earth do you sleep well at night? This talk is all about bootstrapping your security program when your startup hasn't even raised seed capital yet.

1. Bootstrapping Security

2. Source: Reuters
“BofA’s Bessant says to spend $600
million on information security”
- CNBC, October 4th, 2017
She also added that BofA would spend the same amount in 2018,
and that it has 1,200 employees “dedicated to that effort”.

3. Introduction
Jared Casner
@jaredcaz
VP of Engineering
Rob Shaw
@borwahs
Principal Engineer
CNote is a fintech company founded in 2016 that offers scalable
socially responsible investments to institutions and individuals.

4. Security tools and ideas for
a BIG IMPACT
with a small budget

5. Job Descriptions
Engineering
“...design, develop, and secure software…”
QA
“...testing quality and security of software and systems…”
Customer Service
“...responsible for customer satisfaction and security…”
Marketing
“...and maintaining security of prospective customer records…”
Finance
“...and securing access to finances…”

6. Source: Varonis blog

7. Education

8. Automatic Detection

9. Logging / Reporting

10. Other Tools

11. Cost Savings Techniques

12. Sample Costs for Perspective
● Job Descriptions - $0
● Threat Modeling - $0
● Free Tools - $0
● Education - $50 each for BSides
● Logging/Reporting - $10 - $120 / month
● IDS/IPS - $0.01 to $0.06 / hour / machine
● Antivirus - $50 / employee
● AWS Security Hub - depends on usage, but starts very low
● Servers (SonarQube + VPN) - < $20 / month
Assuming 10 employees and 10 servers,
you can do all of this for < $5k / year

13. Get in touch
Jared Casner
@jaredcaz
VP of Engineering
Rob Shaw
@borwahs
Principal Engineer
CNote Github