Key takeaways
- Automate the basics on every pull request
- Protect secrets and access first
- Practise incident response before you need it
Small teams often put security off until an enterprise customer sends a questionnaire. By then it is a scramble. Most of this list costs little to set up early and a great deal to retrofit.
In the pipeline
- Dependency scanning, with alerts for known vulnerabilities.
- Secret scanning that blocks credentials before they reach the repository.
- Static analysis for common security bugs.
- Scanning of container images.
Access
- Single sign on and multi factor authentication on every tool, including the ones only interns use.
- Least privilege roles in cloud accounts.
- Production access that is logged and expires on its own.
Data
- Encryption in transit and at rest.
- Backups that you have actually restored at least once. An untested backup is a hope.
- Personal data mapped and kept to the minimum.
Operations
- Logs collected in one place and kept for a defined period.
- Alerts for unusual access and error spikes.
- An incident response plan with named owners, rehearsed twice a year.
Assurance
- A penetration test before major launches and at least once a year.
- A short security overview you can send to clients when they ask.
Have a question about this guide? Write to us or ask Colony, our AI guide.