Security on a Shoestring: A Low-Budget Security Revival Tour

Security on a Shoestring: A Low-Budget Security Revival Tour

Speakers: Jared Casner, Co-founder, Blacksmith Infosac

Conference: BSides SF

YouTube: https://www.youtube.com/watch?v=s2l9UyCPpk0

Overview

In "Security on a Shoestring: A Low-Budget Security Revival Tour," Jared Casner, co-founder of Blacksmith Infosac, delivers a pragmatic and actionable guide for startups and small to medium-sized businesses (SMBs) to establish robust security programs without the luxury of enterprise-level budgets. The talk is a revival of a presentation Casner first gave six years prior, updated to reflect the evolving threat landscape and the democratization of security tooling. It's specifically tailored for organizations initiating their security journey, whether driven by customer compliance requirements (like SOC 2, HIPAA, or CMMC) or the inherent need to protect sensitive data and build secure software from day one.

Casner emphasizes that building a security program is a marathon, not a sprint, and that early, consistent effort—even with limited resources—yields significant long-term dividends, akin to a 401k investment. He navigates through core security domains, offering cost-effective strategies, free tools, and mindset shifts that enable small teams to achieve a strong security posture. This talk is crucial for anyone feeling overwhelmed by the perceived cost and complexity of cybersecurity, providing a clear roadmap to implement impactful security measures that safeguard business operations and customer trust.

Background

▶ Watch: Introduction: Security on a shoestring for startups (0:50)

The genesis of this talk stems from a pervasive challenge in the tech industry: startups and SMBs often launch products and collect sensitive data without a foundational security program in place. Casner recounts his personal experience, having joined ten different startups where he inherited production systems handling social security numbers and protected health information (PHI) with virtually no security oversight. This common scenario highlights a critical gap where businesses, focused on rapid innovation and market capture, defer security until it becomes a costly, reactive necessity, usually driven by a demanding customer or regulatory body.

Since Casner first delivered this talk six years ago, the cybersecurity landscape has undergone significant shifts, which he meticulously integrates into this updated presentation. Key changes include:

• Fish-Resistant MFA and Passkeys: The widespread adoption of WebAuthn in 2019 and the subsequent rise of Passkeys have revolutionized multi-factor authentication, making it more secure and user-friendly by countering phishing attacks. This obviates the need for physical YubiKeys for many users, streamlining implementation.
• Supply Chain as Default Attack Vector: Modern attacks increasingly target the software supply chain, making third-party risk management an indispensable component of any security strategy. Organizations can no longer solely focus on internal security but must scrutinize their vendors.
• Democratized Cloud Security Tooling: The proliferation of cloud security posture management (CSPM) tools has driven down prices and eliminated prohibitive minimum seat requirements, making advanced cloud security accessible even to small businesses.
• DMARC Becoming Essential: Six years ago, DMARC was optional; today, major email providers are "nominally requiring" it, meaning SPF and DKIM records are crucial to prevent emails from being lost or marked as spam, and to combat email spoofing.
• NIST CSF 2.0 Incorporates 'Govern': The addition of the "Govern" function to the NIST Cyber Security Framework (CSF) 2.0 underscores the importance of organizational governance, risk management, and oversight in effective cybersecurity.
• The Rise of AI: While Casner deliberately avoids extensive discussion on AI, he acknowledges its pervasive presence and its potential impact, particularly noting that OWASP Top 10 vulnerabilities are inadvertently being replicated in AI-generated code due to reliance on open-source packages used for training Large Language Models (LLMs).

Casner clarifies that his insights are largely based on his fluency with AWS and asks the audience to "code switch" for other cloud platforms like Azure or GCP. He also stresses that any tools mentioned are illustrative examples, not endorsements, encouraging attendees to research alternatives that best fit their specific needs and budget. The overarching goal is not merely to acquire tools, but to construct a holistic, sustainable security program.

Key Findings

▶ Watch: Embracing fish-resistant MFA and passkeys for users (2:55)

The core message of Casner's talk is that effective security is attainable for organizations of all sizes, regardless of budget constraints, by adopting a strategic, programmatic approach. His key findings and contributions can be summarized as follows:

1. Security is a Program, Not Just Tools: Casner firmly asserts that simply buying security tools does not equate to having a secure environment. A robust security program integrates policies, processes, people, and technology, all aligned with a chosen security framework.
2. Start Early, Reap Compounding Benefits: Drawing an analogy to a 401k, Casner highlights that initiating security measures early, even small ones, allows for compounding benefits over time, making the journey significantly easier and cheaper in the long run. Waiting until compliance is mandated (e.g., a customer requiring a SOC 2 report) leads to rushed, expensive, and often less effective implementations.
3. Leverage Free and Low-Cost Resources: The talk provides numerous examples of how to implement critical security controls using open-source tools, native cloud provider services, free templates, and even AI. This includes using AI for policy generation, free CSPM tools, and educational content from CISA or YouTube.
4. Time is a Valuable (and "Free") Resource: Casner points out that many foundational security activities, such as documentation, staff education, and manual audits, primarily require time and effort rather than direct financial outlay. This "sweat equity" can build a strong security baseline.
5. Prioritize Foundational Elements: Instead of chasing the latest enterprise solutions, SMBs should focus on fundamental security hygiene: strong identity and access management (IAM), secure network configurations, centralized logging and alerting, and robust backup strategies. These form the bedrock upon which more advanced controls can be built.
6. Accessibility of Enterprise-Grade Security: Many once-exclusive enterprise security concepts and tools, such as Endpoint Detection and Response (EDR) and Mobile Device Management (MDM), have become commoditized and affordable, making them viable for smaller budgets.
7. Strategic Negotiation and Partnerships: Casner advises actively negotiating with vendors, even those with credit card swipe transactions, as well as leveraging VARs (Value-Added Resellers) and MSPs/MSSPs (Managed Service Providers/Managed Security Service Providers) to access tools with high minimum seat counts or for specialized expertise on an hourly basis.
8. Cost-Benefit Analysis Drives Decision-Making: The talk implicitly encourages a mindset where every security investment, whether time or money, is evaluated for its impact on reducing risk versus its cost. This leads to prioritizing measures that offer the greatest security uplift for the lowest expenditure.

Technical Deep Dive

▶ Watch: Supply chain now default attack vector: third-party risk (3:30)

Casner meticulously breaks down a security program into actionable components, offering specific, low-budget strategies for each.

Planning and Governance

• Security Frameworks: The journey begins with selecting a framework. Casner recommends NIST CSF 2.0 for its overarching umbrella approach or CIS Controls (specifically IG1, IG2, IG3) for a more opinionated, step-by-step implementation guide, especially for those new to security.
• Policies: While ChatGPT or Gemini can generate 90-95% correct security policies, Casner advises a more robust approach for future compliance needs. For initial setup, AI-generated policies are a good starting point.
• Ownership: A critical concept is "one throat to choke." Every policy and aspect of the security program must have a single, clear owner responsible for its implementation, maintenance, and approving exceptions. Lack of clear ownership leads to neglect. Integrating security responsibilities into job descriptions and annual reviews incentivizes staff to prioritize security.
• Threat Modeling: Understanding what assets need protection and how they might be attacked is fundamental. This exercise, akin to risk mitigation, helps focus security efforts effectively.

Education

• Free Resources: Education doesn't require expensive platforms. Casner points to sudo.pagerduty.com for free, though slightly dated (last updated 2021), PowerPoint templates for developer and general staff training. CISA and YouTube are excellent sources for understanding social engineering, phishing, and other attack vectors.
• Storytelling: Personalizing security lessons makes them more impactful. Casner shares an anecdote about a middle school where an open Airdrop led to the sharing of inappropriate images, emphasizing how real-world consequences drive home the importance of security practices, both at work and home.

Identity and Access Management (IAM)

• Principle of Least Privilege: This core tenet dictates giving users (human or AI agents) the minimum necessary access to perform their jobs. It's easier to grant access later than to revoke it, a lesson learned from trying to take a cell phone from a 14-year-old.
• Fish-Resistant MFA and Passkeys: Casner strongly advocates for these, noting their ubiquity and frictionless user experience compared to older MFA methods. WebAuthn is a key enabler.
• Short-lived Credentials: Reducing the lifespan of bearer tokens minimizes the window of opportunity for attackers if credentials are compromised. The optimal duration balances security with user experience.
• SSO and SCIM: Where possible, implement Single Sign-On (SSO) and System for Cross-domain Identity Management (SCIM). Casner criticizes vendors who gate these essential features behind expensive enterprise plans, but stresses their importance for streamlined access management.
• SSH and RDP: Ideally, systems should be ephemeral, eliminating the need for direct SSH or RDP access. Cloud providers like AWS offer session management tools (e.g., AWS SSM) that provide equivalent access with full keystroke logging, without exposing port 22 to the internet, and with credentialed access.
• VPN vs. ZTNA/SASSY: While Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASSY) are ideal, they are often expensive. Casner argues for VPNs as an affordable starting point, especially consumption-based options like AWS VPN (cents per hour), as "something is better than nothing."
• Password Managers/Credential Vaults: Essential for secure password sharing. Tools like 1Password offer plans for as little as $20/month for up to 10 users, making them highly accessible.
• User Audits: Regularly (quarterly or annually) auditing user access across all systems is crucial to identify "ghosts in the system"—former employees or contractors who still retain access. Casner cites a lawsuit where an offboarded employee still received executive meeting summaries from an AI notetaker due to neglected access removal.

DNS and Security Headers

• DMARC: No longer optional, configuring SPF and DKIM records with quarantine or reject policies (not p=none) is mandatory for email deliverability and preventing spoofing. This also helps identify "shadow IT" instances where departments use unauthorized email services.
• DNSSEC: Implementing DNSSEC and prohibiting the transfer of DNS records are vital for DNS integrity.
• Security Headers: Tools like securityheaders.com help check and implement critical headers, including Content Security Policy (CSP). Enforcing HTTPS everywhere is a baseline requirement. Building a CSP from day one is far easier than trying to retrofit it onto a legacy application.

Third-Party Risk Management (TPRM)

• Reading SOC 2 Reports: Casner warns against merely accepting a SOC 2 report at face value. Organizations must critically read these reports, verifying that the services they use are actually in scope. He recommends s2gild.org as an excellent open-source rubric for understanding SOC 2 reports.
• Custom Security Questionnaires: Instead of sending lengthy SIG or SIG Lite questionnaires, Casner suggests creating concise (10-20 questions), pointed questionnaires tailored to the specific vendor and service. Customizing these questions based on the vendor's SOC 2 report encourages more thoughtful and accurate responses, avoiding superficial "yes/no" answers.

Application Security (AppSec)

• OWASP Top 10: Casner laments that the OWASP Top 10 vulnerabilities, first released in 2003, have remained largely unchanged. He highlights the irony of SQL injection being a persistent problem, now mirrored by prompt injection in LLMs because developers still fail to sanitize input.
• Testing Tools: Free tools like ZAP Proxy and Burp Suite (Community Edition) enable basic application security testing.
• Code Reviews: While human code reviews are ideal, AI-powered tools can serve as a valuable acceleration, especially for solo developers, providing a baseline level of assurance.
• Software Component Analysis (SCA): Tools like Dependabot and Snyk help identify vulnerabilities in third-party libraries. GitHub provides an SBOM (Software Bill of Materials) out-of-the-box.
• Static Application Security Testing (SAST): Tools like SonarQube (free) and AI-powered alternatives can find vulnerabilities in source code. While they often produce false positives, they are "better than nothing" for improving the security baseline.
• Intrusion Detection/Prevention (IDS/IPS): Casner notes that affordable IDS solutions are available in the AWS Marketplace for as little as 1-6 cents per hour per instance, providing peace of mind even if not industry-leading.

Logging and Alerting

• Centralized Logging: Casner recounts a client who didn't know how to spell HIPAA but handled PHI, and had no logs at all, debugging in production with a Rails console. This highlights the critical need for centralized logging. Solutions range from self-hosted ELK stacks to commercial SIEM vendors. Blumira offers cheap options, and DataDog is affordable for small startups (e.g., $2.50 per million logs per month, totaling $300/year for 10 million logs).
• Alerting and Paging: Logs are useless without alerts. Free tools like PagerDuty and OpsGenie (for teams under 5 developers) can provide critical notifications when anomalies or incidents occur.

Endpoint and Cloud Security

• Endpoint Detection and Response (EDR)/Next-Gen AV: These tools, once exclusive to enterprises, are now commoditized and available for around $50 per month per user, making them a crucial addition to any security stack.
• Mobile Device Management (MDM): Simply having an MDM solution isn't enough; it must be properly configured. Casner shares an example of a stolen laptop where full disk encryption and screen lock were not enforced, exposing data. Hiring an MSP or MSSP for initial configuration can prevent significant heartache.
• Cloud Security Posture Management (CSPM): Cloud providers offer native tools like AWS Security Hub (which includes Inspector and GuardDuty) to track vulnerabilities and monitor CloudTrail logs.
• Asset Inventory and Risk Register: Even a simple Excel spreadsheet for an asset inventory and risk register is a critical starting point for understanding what needs protecting and what risks the organization faces.
• Backups: While the ideal is the 3-2-1 rule (3 copies, 2 different media, 1 offsite), Casner stresses the importance of simply starting to back up critical data.

Thrift Shopping and Budgeting

• Free Content: Attending conferences like BSides SF or leveraging free expo hall/keynote passes for larger events like RSA, along with online recordings, provides invaluable education.
• VARs/MSPs/MSSPs: These partners can help access tools with high minimum seat counts by reselling licenses or providing hourly configuration and management expertise.
• Negotiation: Casner encourages negotiating with all vendors, even those with credit card swipe payment models, as most are willing to discuss pricing.
• Budget Alerts: Setting strict cost budgets and alerts prevents unexpected spending spikes.

Casner concludes the deep dive by illustrating a hypothetical budget: $300/year for centralized logging (DataDog), $200/year for IDS (10 instances at 2 cents/hour), $500/year for EDR (10 employees at $50/year), plus MDM and a password manager. This totals less than $5,000 per year for a foundational security program, proving that "security on a shoestring" is not just possible, but practical.

Demo / Proof of Concept

▶ Watch: Focus on building a security program, not just tools (5:20)

Jared Casner's talk did not include a live technical demonstration or a specific proof of concept of a security exploit or tool. Instead, the entire presentation serves as a conceptual proof of concept, illustrating how a comprehensive security program can be built and maintained with minimal financial outlay. His practical advice, real-world anecdotes, and actionable steps collectively demonstrate that effective security is achievable for small businesses and startups by strategically leveraging free tools, cloud-native services, and a disciplined approach to governance and operations.

Defensive Implications

▶ Watch: Beginning your security program with a robust framework (6:00)

The actionable advice presented by Jared Casner offers crucial defensive implications for organizations operating on a limited budget:

1. Prioritize Fundamentals: Defenders should focus their initial efforts on establishing core security hygiene rather than chasing advanced, expensive solutions. This includes robust Identity and Access Management (IAM), a clear asset inventory and risk register, and reliable backups (aiming for the 3-2-1 rule).
2. Embrace Least Privilege and Strong MFA: Implement the principle of least privilege across all systems and enforce fish-resistant MFA or Passkeys wherever possible. This significantly reduces the attack surface and the impact of compromised credentials.
3. Harden Email and Web Presence: Immediately implement DMARC with SPF and DKIM records set to quarantine or reject to prevent email spoofing and ensure deliverability. For web applications, enforce HTTPS everywhere and configure strong security headers, including a Content Security Policy (CSP), from the outset.
4. Vet Third-Party Vendors Diligently: Defenders must critically review SOC 2 reports and use tailored, pointed security questionnaires to understand and mitigate risks posed by suppliers. Assume third parties are a potential weakness until proven otherwise.
5. Leverage Free and Cloud-Native Tools: Utilize readily available open-source tools (e.g., ZAP Proxy, SonarQube), free tiers of commercial products (e.g., PagerDuty, OpsGenie for small teams), and cloud provider-native security services (AWS Security Hub, SSM, GuardDuty, Inspector) to gain visibility and implement controls without significant investment.
6. Establish Centralized Logging and Alerting: Implement a centralized logging solution (even a basic one like a cheap SIEM or ELK stack) and integrate it with an alerting system. This is fundamental for detecting anomalies, responding to incidents, and debugging, preventing scenarios like the client logging PHI in production without oversight.
7. Ensure Proper Configuration of Security Tools: Simply acquiring tools like EDR or MDM is insufficient. Defenders must dedicate time to properly configure these tools, enforcing policies like full disk encryption and screen locks. If internal expertise is lacking, engage MSPs or MSSPs for initial setup and ongoing support.
8. Automate and Integrate Security into Development: Integrate Software Component Analysis (SCA) and Static Application Security Testing (SAST) into the CI/CD pipeline. Even AI-assisted code reviews are better than none, helping catch vulnerabilities early.
9. Foster a Security-Conscious Culture: Make security a shared responsibility by including it in job descriptions, providing regular education (using free resources), and sharing real-world security stories to make the lessons relevant.

By following these defensive implications, even organizations with minimal budgets can build a resilient security foundation, proactively mitigate risks, and effectively respond to threats.

Key Takeaways

• Start Early and Consistently: Initiating a security program early, even with limited resources, yields compounding benefits over time, making it significantly easier and less costly than a reactive approach.
• Security is a Program, Not Just Tools: Focus on building a holistic program encompassing policies, processes, people, and technology, rather than merely acquiring disparate security tools.
• Leverage Free and Low-Cost Resources: Maximize the use of open-source tools, free cloud-native services, AI-assisted policy generation and code review, and free educational content from platforms like CISA and YouTube.
• Prioritize Foundational Controls: Implement core security practices such as the principle of least privilege, fish-resistant MFA, short-lived credentials, DMARC, centralized logging with alerting, and robust backups.
• Critically Evaluate Third Parties and Configure Tools Properly: Don't blindly trust vendor SOC 2 reports; scrutinize them and use custom questionnaires. Ensure all security tools, like MDM and EDR, are correctly configured to enforce security policies.
• Make Security a Shared Responsibility: Integrate security into job descriptions, provide engaging education, and foster a culture where everyone understands and contributes to the organization's security posture.

About the Speaker(s)

Jared Casner is the co-founder of Blacksmith Infosac, a company dedicated to helping Managed Service Providers (MSPs) and Small to Medium-sized Businesses (SMBs) establish effective security programs without requiring enterprise-level budgets. With over 25 years of experience in building secure software, Casner has spent the past 15 years leading software and cybersecurity initiatives at various Silicon Valley startups, primarily within the Gtech, healthtech, and fintech sectors. His extensive background provides him with a deep understanding of the unique security challenges faced by startups and resource-constrained organizations, making him a credible and practical voice in the field of accessible cybersecurity.