Security

Overview

Security focuses on preventing unauthorized access to your organization's systems, software, and data. While this requires contributions from the entire organization, platform engineers are typically responsibility for building secure practices in the following areas:

• System Access: How your organization ensures that access to various systems is granted only when necessary. This includes establishing patterns for role-based access control, reducing the use of static credentials, keeping detail audit trails, and much more.

• System Configuration: How your organization validates and approves system changes in order to align with compliance standards, prevent security lapses, and create awareness about the current state of the system.

• Network Traffic: How you organization protects your networked infrastructure and in-transit data. This includes not only preventing malicious inbound traffic but also unintended egress of sensitive data.

• Vendor Management: How you assess vendor security practices and manage their access to your systems and data. Often this involves ensuring that any vendor with sensitive access adheres to industry standard frameworks for system and organizational controls such as SOC 2.

• Software Supply Chain: How your organization evaluates third-party code for vulnerabilities and exploits. As organizations increasingly rely on third-party code for the vast majority of their own software's functionality, this has become an increasingly important threat vector to build secure practices around.

• Date Storage: How your organization ensures that persisted data cannot be exfiltrated by an attacker.

• Physical Asset Management: How your organization ensures that physical assets such as office spaces or employer-provided hardware (e.g., laptops) are secured against unintended access, damage, theft, or other misuse.

While specific security practices will vary significantly depending on your organization's context, there are many best-practices that should apply to the vast majority of software companies. We provide that list below. 1

Importantly, great security practices should address the above threat vectors without negatively impacting the experience or performance of your organizational stakeholders.

Motivation

This pillar provides organizational value for the following reasons:

• Prevents risks to business continuity:

  • loss of ability to deliver business services (e.g., denial-of-service attacks)
  • irrecoverable data loss (e.g., ransomware attacks)
  • regulatory fines or injunctions

• Prevents damage to public reputation and customer trust caused by security breaches

• Improves development velocity by

  • providing well-defined standards for the software-development lifecycle
  • unifying system access controls (e.g., single sign-on)
  • improving tooling for dependency management

• Reduces loss of development velocity caused by

  • remediation of security risks or incidents
  • remediation of concerns during customer security evaluations
  • internal consternation over insecure practices

• Unlocks new customers and partnerships that require industry-standard certifications such as SOC 2, PCI DSS, HITRUST, etc.

• Reduces costly cyber insurance premiums

Best Practices

This list is meant to serve as a starting point that covers fundamental security practices. Additional practices may be necessary depending on your organization's goals and context.