The basic checks to start securing your company

At XFA, we are in contact with many startups that are taking their first steps in security. When we hear "we know we should do something about security, we just don't know where to start", we know we have to adapt our advice to their reality.

Before XFA, I was CISO at a Belgian media company. That is a totally different challenge from what smaller companies experience, but it has allowed me to follow how security needs evolve as a company matures. In other words, you get more resources but also more complexity.

For startups, our message is one of encouragement: the fact that the conversation is taking place indicates an awareness that doing something is better than doing nothing and waiting until the next stage of business maturity.

My starting advice is based on two themes: helping people work securely and building robust processes so security isn’t an afterthought.

Help people with their passwords

It’s a reality that many people choose weak passwords and reuse them across tools. This lack of awareness is rooted in the fact that, fortunately, the average individual hasn’t been the victim of a cyber incident that starts with a compromised password. But in a professional environment, it’s more common to become a target, and the stakes are higher.

A password manager is a logical first step that helps us solve that. It generates a strong, different password for every account and stores them, so users only have to remember one. You will still need to invest in communication, awareness, and active checks, so that using it doesn’t become optional.

Keep devices updated, with a passcode, and encrypted

Startup life can be chaotic, and we know it. A vibrant mix of employees, freelancers, and advisors is working on building something big. By its nature, this work happens on a mix of personal and company devices.

The first security measure is usually a signed policy in which everyone solemnly promises to keep their devices secure. For a long time, this was the only available option if you didn’t have an IT team, which tends to be built later as the company grows.

Fortunately, technology evolves, and we now have solutions to check the security of devices without adding overhead. That is the core of what we do at XFA.

Treat least privilege as a habit

In a small team, it can happen that everyone gets access to everything. It is faster, and when you are only five people it feels harmless.

Least privilege, giving people access based on their job needs, is a conscious organisational design choice that will save you time in the long run. Clear role-based access that is updated when people join, switch roles, or leave is one of the few security habits that gets cheaper the earlier you start it.

To clarify, I’m not saying you need to spend time designing a complex permissions matrix that will serve you as a corporation. Three or four roles can cover most of the team and help you avoid a complex set of growing pains. First, avoid shared logins, so that actions from multiple people are not recorded under the same user. Second, whoever holds the keys to Google Workspace or AWS keeps a second account for daily work. Third, temporary access gets an end date when it is granted, and writing down the tools someone uses removes unnecessary risk at offboarding.

Start securing without overhead

Perfect security does not exist in any company. The objective is to have a setup that matches your current reality and risk appetite. The checks we have shared are a sensible starting point: they close the gaps attackers rely on most, and they let you feel secure about how your company works day to day.