Every tech startup has questions about cybersecurity. Or at least, they should.
Baan Alsinawi, the founder and president of D.C.-based TalaTek, has spent 13 years operating a platform focused on both controlling digital security and minimizing risk for organizations. She knows how technology can be leveraged to protect young companies' assets, and knows how building the right security teams and solutions early is invaluable.
Alsinawi has more than two decades of experience in information technology, with previous roles spanning network management, software sales and security operations. Those experiences and the desire to create state-of-the-art solutions is what prompted her to start her own company in 2006.
Recently, she was called one of the “100 Fascinating Females Fighting Cybercrime” in the new book “Women Know Cyber.”
DC Inno talked to Alsinawi about the data risks startups face in the Age of Information, and what questions they need to answer to build a proper cybersecurity strategy.
Where does Talatek fit into the cybersecurity realm, and what are the major threats you look at?
TalaTek was founded in 2006 and offers compliance and risk management services. As a small firm delivering cybersecurity services, TalaTek has had to be extra vigilant about managing its own security, protecting its data and its clients’ data. The threats that a small firm face aren’t really any different than large firms – all organizations should establish proper policies, protect data, manage secure access and be vigilant in the face of ever-evolving threats.
What are the greatest cyber threats to startups, and where are they usually most vulnerable?
Establishing a mature risk management program is both time consuming and costly. Startups strapped for cash and focused on their new business ideas will likely consider a risk management strategy a luxury and operate without one.
However, startups need to make a good first impression and really cannot afford the risk of losing client data or being unavailable when services are expected or delivering suboptimal services.
What are the biggest mistakes that tech firms make with their IP and company data?
The biggest mistakes that tech firms make is assuming that they are too small and not at risk. Start the company with a simple but effective risk management strategy that enables an organization to strategically protect its most critical data.
What are some simple measures that will increase your startup's data security?
Keep it simple and follow a few fundamental steps that don’t need to be too complicated or costly, and yet manage risk effectively. I would also suggest having a good insurance policy in place covering the types of risk specific to the business, making your staff aware of social engineering and data loss risks, as well as controlling access to critical data and selecting reputable secure third party vendors for outsourced services.
For a small company, how do you decide how much to invest in IP/data protection?
A better way to determine this is to ask the question how viable is an organization if they lost data, access or delivered insecure services. Once a company figures this piece out, then an organization can calculate their investment.
What are the most important things to invest in?
Evaluate where an organization’s exposure is as a business and work out worse case scenarios. For example, a business should ask, if their website was not available can it sustain the business? If client data was exposed will the business withstand the reputation loss? The answers determine what’s most important to invest in.
If you could give an early-stage tech company one piece of advice on protecting their digital assets, what would it be?
Allocate a budget to managing your risk as part of your business plan. This will serve as the foundation for a strategic plan that protects your most critical assets since you can’t protect everything. This way, you are putting your valuable resources against your most important assets.
