Publications

SaaS-based startups face distinct security challenges requiring a tailored approach. These companies often begin with small security teams and limited budgets, yet customers expect them to achieve full maturity quickly. This second edition (first published 2017) provides comprehensive guidance specifically for SaaS-based startups, emphasizing strategic decisions and tactical recommendations for achieving enterprise-level security maturity.

The goal of this document is to map the various attack vectors that are actually being used during cloud-based attacks in IaaS/PaaS and to map the vectors and their mitigating controls to various resources. The motivation for this document came after we analyzed much research around cloud security and realized that they are listing a combination of risks, threats, attack vectors, vulnerabilities, and concerns. And while there are many risks and threats to IaaS/PaaS platforms and applications, most of the risks are associated with a very specific number of attack vectors.

In modern application workloads, organizations are often required to integrate their application with other parties such as Software-as-a-Service (SaaS) providers, customers applications, and business partners. The purpose of this document is to provide a framework for securely connecting external entities such as customers or third parties. The document provides a usable list of security considerations in order to estimate the risk involved with the specific connectivity and a technical checklist for the implementation of security controls.

As a Software-as-a-Service (SaaS) startup, it's important to build solid security foundations in order to gain and maintain customers' trust. This document provides an outline of cloud security best practices that SaaS organizations should follow, including guidelines for application security, platform security, and security management. Designed for founders, CTOs, product managers, and architects of cloud-based startups developing on public IaaS/PaaS.