Virtual CISO for Tech Startups – Why it’s Crucial

Virtual CISO for Tech Startups – Why it’s Crucial

 

Virtual CISO for tech startups. It is crucial. I’m going to give you four reasons why a virtual CISO is crucial to get involved with a tech startup.

 

My name is Tony Asher. I’m the lead cybersecurity advisor for Asher Security, and we help tech startups. We have a long history, and a lot of experience helping tech startups.

 

Matter of fact, I’m working late tonight on a project for a friend that involves a tech startup. So, this came to mind, and I just wanted to take a minute and share with you if you’re in a tech startup and you’re considering, “should I invest in getting a virtual CISO?” My opinion is absolutely hands down, no question, positively yes. I hope that’s clear.

 

It doesn’t have to be me, but make sure you work with some kind of cybersecurity professional. I’m going to give you four reasons.

 

Crown Jewels

The number one reason is in a tech startup, what you’re developing is your crown jewels.

 

Data is currency, and you’re developing data and a process and an application that you’re going to go out and offer to the world. If that information is lost, that’s what we call intellectual property, the value of your solution goes down. The tech startups that I’ve worked invest a lot of money in building their solutions.

 

The last thing you want to do is lose that intellectual property to an external hacker. And it doesn’t just come from external hackers. And that bring me to the second reason a Virtual CISO is crucial to tech startups.

 

Protecting Intellectual Property

 

What I’ve seen is tech startups will often go ahead and hire an external application development firm to speed up that process. And I understand speed is critical in tech startups, especially when you’ve got a runway that you’ve built because of the investors that have trusted you to build this solution. What happens is sometimes the leader who’s taking care of the business side of the tech startup is not the same person that’s leading the technical side of the development.

 

So that person is either internal, they’re a partner, or they’re an employee, or they’re an external group. When you build code, that code goes into what we call a code repository. And the tech person has ownership rights to that.

 

And when there’s a conflict in a tech startup, believe me, there are, the tech person will typically hold the keys to that intellectual property. Everything you’ve been investing in, everything you’ve been building up to this point can now be held ransom by someone else. A Virtual CISO can help make sure that access to that property is shared amongst owners and it cannot be ransomed by a single person.

 

 

Cloud Security

The third thing a Virtual CISO can help with a tech startup is cloud security. When I talk about cloud security, I’m essentially focused on one thing that I still have a bruise over.

 

And that is when you host your technical product on a platform, again, oftentimes the development group will take the role of the root account within that cloud service provider. I know I’m throwing a lot of words out. If you think about it like this, I’ve got an app, I’ve built it and it’s super cool. And I want you to help me get it out to the world. And the application development company starts an account on Amazon Web Services. And when they do that, they register the main administrative account, which we call the root account, and they have the password to it.

 

So, no matter what other passwords or credentials are created, they have administrative access and they can change that. And again, if there’s a conflict or what I’ve seen is that development company go under overnight, maybe they’re overseas, it can go away. And now you’ve lost access to your application and where your application is hosted.

 

 

Network of Relationships

 

Now, the fourth way a Virtual CISO can help a tech startup is just by leveraging our network. It’s not all about me or cybersecurity or whoever you’re working with.

 

But tech startups move the fastest as any other company that I’ve worked for. I don’t even know how you differentiate that. They move super quick.

 

They have to make decisions quickly and they have to find resources quickly. So by working with a Virtual CISO, someone who has experience in the tech startup, they can help you pivot and get the resources you need for the specific technical needs that you have at that time. And that can be really beneficial.

 

The elephant in the room, obviously, is how can a tech startup take on the cost of a Virtual CISO? Well, hopefully, Virtual CISO will have a package that works for you. You know, sometimes it becomes expensive because that Virtual CISO is spending a lot of time. But if you just get a package that allows that Virtual CISO to have oversight, provide regular engagements and pointers and strategies, that can be very cost effective.

 

And the flip side is you can’t afford not to have someone in the cybersecurity role because there’s so much at risk. So really, what you invest in cybersecurity is going to pay dividends later on. Especially if your tech startup has an exit strategy of being sold, that company will oftentimes look at the cybersecurity and the availability of that technical solution. So, at that point, you’re going to make up whatever you spent in cybersecurity and much, much more in my experience.

 

Finally, one other thing I want to talk about is when you start going out to market to find customers for your tech startup, many of them will ask cybersecurity questions. Now, if you have a long runway, you’ve got a lot of investment, you might be able to take on the financial burden and the resource burden of going and getting a market leading attestation or certification, like a SOC 2 Type 2. You’re going to want to work with a cybersecurity resource to achieve this, but it’s going to be very powerful.

 

It’s going to be a very valuable card in your pocket. When you go to work with those customers or those prospects, and they see you have a SOC 2 Type 2, it’s really going to reduce the time to sell and leverage and build the revenue model for your tech startup. If you do not want to take on that financial burden or that time burden or that resource burden, the other thing that Virtual CISO can help with your tech startup is doing what I call a one pager.

 

Now, oftentimes this is two pages, but what I like to do for my tech startup customers is just write up a summary about what it is that our, how our program approaches cybersecurity and secures their data and secures our technical solution. I’ll talk from everything about what framework we align with from a cybersecurity perspective, to our cloud controls and best practices, to our logs and monitoring, to our identity and access management controls, and if there’s EDR or endpoints in there, backup and recovery plan. You can do all this very briefly, four to five sentence paragraphs on each of these management pillars within cybersecurity, and now you have this simple PDF that you can hand to prospects, and right away you just see that their shoulders kind of sink like, oh this tech startup has thought about cybersecurity, they care about security, they care about our data, and they’ve obviously invested in it from the start, and that really helps grease the skids to make your prospect engagements much more successful.

 

I hope those reasons of working with a Virtual CISO for your tech startup make sense, and it is crucial. If you have any questions, let me know.