UpGuard

> Limited IO bandwidth in middle and upper management alongside difficult schedules (we covered that one already). Take 2 steps above engineer on an org chart and detail becomes invisible, the vast majority of tasks begin to resemble a teenager at a mall with their dad's credit card. Meaningful technical validation phases are almost unheard of in many organizations, and largely antithetical to agile.

I'm sorry, but what are you trying to say? "Antithetical to agile" - is there a point beyond some non-nonsensical, made up scenario? Every major organization with a cloud budget cares about optimization today at some level. This hasn't changed in over 20 years because those budget dollars used to be directed at data center costs. Now they're more fluid and can be more impactful when people make mistakes or aren't making sure to optimize up front.

> Because they market to folk who never take the time to model comparative costs. In any project I considered them for (3 I think, <$15k/year each), Digital Ocean was significantly more expensive than AWS. I follow my spreadsheets, the industry follows marketing.

Then share some examples from said "spreadsheets". Because for straight instance pricing DO beats AWS pricing in most every way. This is one of a handful of bread and butter services AWS offers (lift and shift compute). DO also does, most often, better with respect to performance (CPU/compute) when comparing directly [0][1][2][3]. This calculator [4] at DO showcases…

Security and privacy are complex topics—most developers I’ve come across aren’t deeply familiar with best practices or well trained to architect secure systems. Also, security, privacy, and compliance collectively form some of the most substantial challenges for small and medium sized SaaS companies when selling to enterprise customers. On the consumer side, the massive influx of recent data leaks (https://www.upguard.com/blog/biggest-data-breaches) make this issue critical.

Similar to what Stripe did for payments, I think the solution lies in abstracting away implementation details for secure architectures that need to commonly be built from the ground up. To name a few concrete components of a secure SaaS application that can be abstracted:

- end to end encryption (for p2p file transfer and for teams)

- multi-tenancy in data architectures

- secure data stores (with row/column, and even element level obfuscation of sensitive/PII data): obfuscation would be dynamic and highly configurable through an ACL style interface

- data severability: the ability for customers of an application to delete (or broadly, govern) their data should they feel at risk

In summary, a highly secure, scalable, and governable data backend for application developers to use instead of building their own. All accessible through an API which can be used a la carte.

Would love to get some thoughts on this approach from the community? What do you think?

PS. If you’d like to chat directly, get in…

Have you ever seen a news article talking about a data breach? They're posted here pretty regularly, and most big news outlets discuss the more important ones when they happen.

I only ask because your comment sounds like you don't think security is a concern for businesses. It is, so much so that worldwide, companies who have been breached spend close to $4 million cleaning up after the incident [1]. In the US it's actually more like $8 million to clean up after a breach. And if you read the report, data leaks (like customer info sitting in an unsecured Google account) account for half of all breaches.

[1] https://www.upguard.com/blog/cost-of-data-breach

I'd like you to understand how Google Docs poses a risk to businesses. Imagine you want to share a customer list with someone else in your company, but you don't want to use Word and OneDrive like IT has approved. So you put it in Google Docs. Now sitting in your personal and unsecured Google account is a list of your company's customers. Maybe some pricing info, maybe the email address of a contact at the company, that kind of stuff. Now your personal Google account is compromised. It happens all the time, but this time the hacker finds your company's info. Maybe they sell it to one of your competitors and your company loses business. Maybe they use it to spear-phish your customers. Maybe your company's customers get breached because you put their information in an unsecured location.

Now lets say this goes on long…

Let's not forget that Alteryx sells the data of 123 Million American Households. That data Was Exposed Online https://www.upguard.com/breaches/cloud-leak-alteryx
"the data was part of a product - the Alteryx Designer With Data - that sells for around $38,995 per license. In its own marketing for the Experian service, Alteryx notes that the database contains "consumer demographics, life event, direct response, property, and mortgage information for more than 235 million consumers." 'It included an extraordinary range of personal details on residents, including addresses, ethnicity, interests and hobbies, income, right down to what kind of mortgage the house was under and how many children lived at the property. In total, there were 248 different data fields for each household, according to the researcher who uncovered the leak data this week.

Whilst there were no names exposed, Chris Vickery, a cybersecurity researcher from UpGuard, told Forbes it was simple to determine who the data was linked to, either by looking at the details or by crosschecking with previous leaks. He found the data was sitting in an Amazon Web Services storage "bucket," left open to anyone with an account, which are free to obtain." https://www.forbes.com/sites/thomasbrewster/2017/12/19/120m-american-households-exposed-in-massive-consumerview-database-leak/#61b6cc047961

UpGuard | Mountain View, CA | Onsite / Partial Remote | Full-Time | https://www.upguard.com/

UpGuard are looking for all types of engineers to work on front and back end technology stacks to build our our next generation configuration & resilience platform. We're looking for smart, driven engineers that have a vision and the ability to build it.

We create enterprise software but operate in a more startup like environment with free lunches, casual work place, equity and a fully stocked beer fridge.

We've recently raised our series B, and are still at a great size where any new employee has a real impact on the product. Own your own projects from start to finish. Have a better idea of how to implement a feature? You're free to build it.

Everyone knows everyone here, culture is a big priority and we look after our staff.

Our stack is Ruby / Rails, GoLang, C#, Postgres, Memcache, Redis, HTML, CSS3, JavaScript, AngularJS, Git, OSX

Im a long time engineer here, drop me a line if you have any questions or want to submit a resume - cheyne (at) upguard.com

These are generic, and quite weak recommendations on the part of the CISA. And that was the excuse of the CIA director, while knowing very well these are for regular work not real-time battle plans.

Also those recommendations from the CISA recommend to use password managers...like Lastpass and 1Password and others, who had multiple security breaches.

If this is the type of Cybersecurity the US government applies to day to day work, its much easier to understand the field day North Korean and Chinese hackers seem to have all the time.

https://www.upguard.com/blog/lastpass-vulnerability-and-future-of-password-security

https://www.forbes.com/sites/daveywinder/2024/08/07/critical-1password-security-flaw-could-let-hackers-steal-unlock-key/