Rootconf Mini 2024

Startups must move fast. Does this mean compromising on security? Everyone will choose security but no startup will have the resources to establish a matured security program from inception. How do you move fast while staying secure even when you have code contributions from interns, software engineers of different experience levels and multi tasking founders?

This talk will share the real world experiences gathered while tackling security in an early stage startup. We will focus on application security only and rely on fundamental security controls such as Authentication, Authorization, Input Validation, Data Validation, Multi-Tenancy, Resource Limits, Auditing and Observability. All of these built as part of the application development framework and used declaratively by engineers while developing a feature. Examples will be in Go but the patterns discussed can be applied in any language or framework.

Key take-aways from this talk:

• Using Protocol Buffers & gRPC for API spec based development
• Declarative input validation using protocol buffers
• Declarative authentication & authorization
• Hooking into API adapters (ConnectRPC) to enforce security controls
• Hooking into the ORM for multi-tenancy & resource limits
• Security observability using metrics

This talk is intended for

• Startup CTO / Head of Engineering
• Platform / Security / Software Engineers

While the title indicates startup, this talk should be useful for any security & engineering team who believes in proactive security controls built within the internal developer platform.