It’s time for startups to get proactive and prioritize security

Founding a company is hard work. Between the start-up costs and time invested in insurance, equipment, sales, and payroll, early-stage technology thinkers and leaders have their hands full. However, arguably the most important aspect, and the one that is most notoriously neglected, is security.

Unfortunately, for many businesses it can be challenging to prioritize the implementation of time-consuming security protocols when those resources could be spent on marketing, hiring talent, accelerating digital transformation, and finding funding.

After years of work to mature their organization, founders do not want to slow down or backtrack. If their data hasn’t been protected or their security is not in line with zero trust protocols (i.e. granting users the minimum requisite level of access to preempt data breaches), their next phase of growth could be inhibited. In addition to high-profile hacks and data breaches hitting an all-time high in 2021, companies must be proactive and guard against a wide range of cyber threats including application security vulnerabilities and distributed denial of service (DDoS) attacks. Startups can’t wait until they’re prepping their company to go public to beef up security measures — at that point it may be too late.

Fortunately, there are several tools and practices startups and midsize organizations can implement to ensure their platforms are safe and sensitive data is protected.

The best way to bolster security measures, especially when it comes to data security, is to build it into software while it is being developed, not after. While this may extend the time it takes to develop and test software — a stressful concept for eager founders or CIOs — it’s much easier than the last-minute panic of integrating security measures after a product has been developed, or worse, hacked. 

Security technology measures such as role-based access control (RBAC) and single sign-on (SSO) are key features to build into any software from the onset. It’s also worthwhile ensuring that all products, data protection, and privacy measures are compliant with GDPR requirements and meet ISO security standards, HIPAA requirements (for organizations in the healthcare space), and crucial security certifications such as SOC2 Type II, CCPA, and PCI compliance.

Another security measure — arguably the most popular and effective — is multi-factor authentication (MFA). According to a recent report from Okta, MFA is estimated to prevent 99.9% of account takeover incidents. This is significant because it forces a higher level of verification for passwords that are notoriously susceptible to being guessed by hackers. In fact, according to the same Okta report, the most popular password of 2021 was 123456, revealing that most people choose to create memorable passwords rather than secure ones. MFA allows founders, CIOs, and security departments to rest easy knowing they are safe from a lack of care in password selection.

Finally, it’s best practice for companies to take a proactive approach to data security and always encrypt their data from the get-go. There is a common misconception that encryption is too complicated or expensive, but in reality, there are a variety of ways to make it affordable and it’s essential for protecting sensitive, confidential data. Encrypted data can be safely stored in the cloud. And cloud offerings are quickly becoming more effective than on-premises servers by providing both encryption in transit and encryption at rest. As data privacy becomes a growing concern for customers, startups and midsize organizations can be lightyears ahead of their competitors by taking a “data safe” approach from the beginning, ensuring that extra level of security on a journey to zero trust. 

Startups and midsize organizations cannot take security measures and protocols lightly. For startups quickly scaling with mobile apps, websites, and software, simply instituting multi-factor authentication can make a massive difference in the security of their users’ data. 

With extra layers of protection from RBAC, SSO, MFA, and data encryption, founders and technology leaders can comfortably grow their businesses and customer base without fear of data breaches and hacks. As organizations grow and do more with their data, startups can set themselves up for maximum market potential knowing they have a robust security model and are well on their way towards zero trust. 

Prashanti Aduma is CIO of Dialpad.