
Edit Story

Culture Is The Most Important Component Of Data Security As Startups Scale

Justin Blanchard
Justin Blanchard is co-owner and chief marketing officer at ServerMania.

The online world is full of threats and shadowy actors driven by political and economic ends to steal and exploit our data. Our best weapons in the war against online criminals are technological tools: encryption, intrusion detection and software audits. But what matters most is the people who use these tools and the incentives those people are given.

Online criminals are motivated by money, and so too are businesses. Criminals generate revenue by attacking businesses and breaching their security — the current ransomware epidemic is an obvious example. Businesses, on the other hand, see almost no immediate financial benefit from security, and because secure systems are time-consuming and expensive to build, they focus on products and features ahead of security. The drive to scale quickly and gather as many users as possible often trumps security concerns.

The human habit of hyperbolic discounting plays a role, too. The future rewards of secure systems are deemed less worthy of attention than the short-term rewards of financial gain or growth — even if the future rewards far outweigh the present benefits. It’s all too easy to choose short-term growth and revenue gains, rather than implementing secure systems. The cost of failing to implement secure systems can lead to catastrophic future losses that dwarf any benefit gained by ignoring security in the short term. But because we’re all prone to hyperbolic discounting and industry incentives reward growth rather than security, it can be difficult to convince colleagues of that truth.

As a provider of IT infrastructure hosting for businesses, we see the results of the temptation to privilege growth over security quite frequently. We’re committed to building secure platforms on which our customers can then build their sites, applications and services, which is why we carry out security hardening on every server we deliver. But we can’t control the security commitment of everyone who uses our platform. Often, our support teams are heavily involved in mitigating the problems caused by less-than-perfect user security.

That’s why security is really a human and managerial issue rather than a technological one. However incredible the security tools we have access to are, if developers and managers are not incentivized to create code and systems that adhere to security best practices, they won’t build systems or implement security-friendly policies that make life difficult for criminals.

Create A Security Positive Culture

How can we make sure our apps and servers are secure as our businesses scale? There’s a balance to be struck. If we were to build perfectly secure and technically correct systems, we’d never get off the blocks. Software at NASA costs billions of dollars to write because it has to be correct. Total correctness is antithetical to disruptive startups and to competitive marketplaces, but there’s a middle way that many businesses would be well advised to adopt.

Incentivize Security

Managers and developers will act according to the organizational incentives and culture of whoever pays their wages. They will hold their noses and implement systems they know to be insecure if that’s what their jobs demand. It’s the function of executives to create a culture in which security is valued alongside agility.

Doing so is easier said than done, and security-conscious executives often face pushback from other senior team members who are incentivized to focus resources elsewhere. One of the most effective ways to ensure that security is given a place at the big table is to hire a Chief Security Officer who is responsible for designing and implementing security processes. To be most effective, the CSO should report directly to the CEO, rather than the CTO or other executive, because the incentives of other departments don’t necessarily align with security. An effective CSO has a budget that’s not beholden to other departments and the authority they need to push security measures through.

Give Developers Time

Secure systems and features take more time to build than insecure ones. If a company is in eternal crunch time, churning out one feature after another on short deadlines, they will be impossible to build. Again, it’s up to executives to create a working environment that encourages technical professionals to do their best work.

  • Encourage developers to approach executives with security concerns, and don’t sweep those concerns under the rug.
  • Empower developers to spend their time addressing security issues, which means making sure they aren’t constantly under unreasonable time pressures to add features.
  • Make security an important component of code reviews and embrace tools for static analysis and automated scanning that can unearth security problems before code goes live.

Join Bug Bounty Programs

Incentivizing internal team members to value security is an important step, but it’s also possible to give incentives to external security researchers and “hackers” who can’t decide which color their hat is. Bug bounty programs like Hackerone are a great way to increase the likelihood that any vulnerabilities in your applications and networks are disclosed to you, rather than sold on the exploit market or used to steal your data.

A Concrete Example: Ransomware

Ransomware likely will be a billion-dollar business this year. But for companies that value security and follow the most basic of security best practices, ransomware is not a significant threat. Two basic security policies will suffice to keep a business safe against most ransomware: patches and backups.

Ransomware almost always exploits known vulnerabilities to infiltrate servers and personal computers; vulnerabilities that have already been patched in the most recent versions of software. By ensuring that the operating systems, programming languages, and applications that run on a business’s machines are kept up-to-date, the ransomware risk is significantly reduced.

Secure, up-to-date, offsite backups render ransom demands fruitless. If servers are infected with ransomware, the business can simply restore from backups after securing their systems.

Patching may cause problems for companies reliant on legacy software, but that relatively rare situation aside, there’s no good reason to decline to update. The tooling and platforms around patching and backing up are mature and uncomplicated to use. Basic security precautions that protect businesses and their customers from the vast majority of attacks are not challenging to implement. The only thing standing in the way of security is a culture that fails to value security and privacy.


Young Entrepreneur Council (YEC) is an invitation-only, fee-based organization comprised of the world's most successful entrepreneurs 45 and younger. YEC members represent nearly every industry, generate billions of dollars in revenue each year and have created tens of thousands of jobs. Learn more at Questions about an article? Email