In the last part discussed the difference between an idea and a patent and how the proper judgment of whether something is in breach of the intellectual property is a gray area. Additionally, we spent some time analyzing the way software companies make an idea to product. We pointed out that all companies usually use already established algorithms and design patterns free of copyright. In this part, we shall discuss some techniques and pain points Start-Up founders must be aware of.
First – this advice is more oriented towards every entrepreneur – please make sure you hire a good lawyer before you do a single step of your Start-Up journey. And by good, I mean a lawyer with good work etiquette and a moral compass between wrong and right. Additional experience in the field is a bonus, but it must not be the main reason you start working with someone. Additionally, a skilled lawyer can help you set up your company in a way, which can save you many troubles in the future.
Second – make sure that you have at least one technical person with legal knowledge. This person will work closely with your lawyer when you have to make a legal decision regarding your technical product and will clear technical details regarding your contract templates, customer complaints, and, in the worst case, if someone decides to attack your organization legally. Ideally, this person must be part of your founding team but not hired.
On the diagram you can see a standard legal contract workflow. After the initial contract you have actions and finally the contract must end with one of the exits
Third – be paranoid. Contracts are invented for both sides to have the worst-case scenarios covered. And by that, we mean the worst-case scenarios indeed. Some examples are death, theft of intellectual property, not honoring the deal from one of the sides, etc. I can give you some tips: make sure you have every exit situation covered; the contract must have a period and if there is a penalty rule, make sure that there is an upper limit for it.
Fourth – make sure you don’t make enemies. A significant percent of legal arguments are because of personal reasons. The most common cause is that someone’s ego is hurt so much that this same person decides to take legal action. From a business perspective, usually, the main reason is that one of the sides chose not to honor their deal and pay some money. Sometimes the cheating side could even fabricate a whole story to get away from court action.
In conclusion, please make sure you treat your customers, partners, and employees well. Not honoring a deal must be triggered only by terrible reasons, which are out of your control. It is the only way your reputation will stay intact, and you will not make yourself a bad name. From my experience, I can give you an example where not honoring the initial deal led to the company losing all of its technical team and a delay of at least two years. Eventually, the company bankrupted.
During the years, I have seen many Start-Up team members lacking the necessary legal knowledge to make effective decisions about what is wrong and what is not wrong to do when working in that field. Many company owners have a too dark and or too light perception regarding the legal requirements when building a new technology-based company. At the same time even more significant number of company owners directly ignore some laws or try bending them to their benefit. As always, the truth is in the middle, and reality is more grayish.
But let’s start with a simple example regarding copyright laws. I am amazed how many people in technology still neglect them and even have no idea how they work. So let’s give them a ride. In their essence, these laws state the following:
On the diagram you can see a standard diagram included in patent papers. It is On the diagram, you can see a standard chart included in patent papers. This diagram is too general, and systems such as computers, smartphones, etc., could be categorized as devices implementing it
Ideas: Ideas are free from copyright. However, here come two questions regarding that statement. First – how do we distinguish an idea from something else? We usually use already established design patterns and algorithms in technology and try to model our ideas using these tools. So, in short, the standard approach of making your concept alive is to use something someone has already invented, but it is not under copyright. Second – having in mind the last sentence, where is the line between an idea and something which must be under copyright? Should we claim the collection of algorithms and design patterns needed for one idea’s implementation to be under copyright?
Patents: For anyone reading patent papers, patents describe the design patterns and logic implementing the idea defended by the patent. At the same time, we could ask the following questions: What happens if we change one of the boxes used in the patent and implement it another way, but not the one described in the patent? Will this invalidate the patent? Will this be enough legally to claim that our Start-Up does not use the patent?
Programming code: By default, every programming code is under copyright. The idea of this setup is to defend the employer legally. However, there are some exceptions for that – what happens if the employee is an outsourcing company or freelancer? What happens if the employee uses a code or skills acquired before starting working with the employer? What happens if the employer has permitted the employee to operate its own company and projects in the same industry? What happens if there was a verbal agreement for partnership between the employer and the employee, but the employer decides not to honor the deal?
In conclusion, the answer to these questions usually is – It depends. Every situation is different, and that’s the reason we have courts for making decisions. Laws typically try following the community’s moral compass; unfortunately, this is not always possible. It is a good idea for us as entrepreneurs to be prepared for any situation using that knowledge. And the list of bad situations includes legal, financial problems, and even personal vendetta from ex-partners and ex-employers. People change with age, and sometimes these changes are for the better, which is why contracts were invented.
Several months ago, I had to make a trip over the weekend to a city sitting 160km far from Burgas. I decided to take the more direct route, which goes through Stara Planina, one of the mountains located in Bulgaria. There were many trucks on the road. Other car drivers and I were driving behind them without a clear opportunity to overtake. I wanted to check something on my smartphone, and I misclicked on the WIFi network indicator. To my surprise, the list showed one item – a WiFi network with a mobile phone number as its name.
And then it clicked in my mind that the two cars in front of me, trying to overtake the truck for the last twenty minutes, were most probably a company traveling together, and the owner of one of the cars was sharing his/her hot spot with the passengers. He/She had most likely decided to name his/her WiFi network with his/her mobile phone number.
The defensive cybersecurity expert in me started clicking with his tongue in disapproval because I now had the driver’s phone number and his/her car registration plate. Additionally, I had the knowledge that someone in the cars in front of me was using the listed WiFi network. With all that information, a motivated attacker could do the following exciting things:
On the diagram, you can see a typical remote attack on a vehicle. The attacker usually uses another vehicle to get data and use it for attacking the target
Find the driver of the car: With some search in the dark web, a motivated attacker could find illegal databases with phone numbers and vehicle registration plates mapped to their owners. Additionally, if the phone number owner had posted an online ad for something using that number, it usually got indexed by most search engines.
Get the metadata of the WiFi users: The WiFi search protocol is quite leaky in terms of metadata sharing. For example, your WiFi client usually broadcasts all the network SSIDs your device was connected to for the last couple of days. Using this weakness, we could collect that data for every device connected to the hot spot and use that data for malicious activities. One such activity is finding the places where the owner of any of the connected devices was. Especially if the owner of the devices regularly connects to public WiFi networks in hotels, cafes, etc. There are many databases in the dark and on the regular web with such mappings betweens WiFi SSIDs and GPS coordinates.
Enforce the WiFi client to connect to a malicious endpoint: With the proper equipment, the attacker could enforce all the WiFi clients to connect to his/her malicious WiFi endpoint and sniff all the data coming from the devices. Modern smartphones software usually comes with proper protection, but bugs happen, and the attacker could keep the collected data and decrypt it offline or in the future.
Social engineer the owner of the car: A motivated attacker could call the owner of the vehicle and present himself/herself as a police officer asking the owner where the car is at the moment and that someone made a complaint about the vehicle parked not correctly. To make the lie ever more truthful, the attacker could tell the driver that he/she and his/her colleague must go and check the car personally. If this attack is performed after work hours, the victim will probably give his/her an address near his/her home.
In conclusion, the car driver in front of me had a bit of good luck that I was driving behind them, but not a criminal. In another case, all of these attack vectors could happen. Unfortunately or fortunately, cars have become more and more intelligent. But with becoming more intelligent, more and more security holes have become open for attack. We should be concerned, especially with the increasing adoption of electric vehicles in our lives. They are, in fact, computers on wheels. And these computers have and will have more and more security vulnerabilities.
In the last couple of months, we discussed how you could achieve a good level of personal security for your team members. We covered the topics of physical information security, home network security, and finally, your hardware devices cybersecurity. With this article, we shall cover the issue of how you can upgrade your cybersecurity defenses as a team. The article will cover the necessities of remote-first groups because they are harder to defend. You can use the same approach to protect your office or shared space-based team. Still, the focus will be on underfunded small groups. At the end of the article, I shall present a sample budget for your team infrastructure.
But before going to the budget, let’s analyze how a remote team of workers communicates and collaborates. I shall list down the different infrastructure requirements for a technical IT team. Keeping in mind how digitilized our World is, they will work fine for any other distributed team.
Communication Channels
For every remote-first team, it is essential to have a communication channel. We can categorize the different communication channels by their speed. But let’s do this in the following list:
Email: Email is usually categorized as an official communication channel, which we can use for communication inside and outside of your organization. It is heavily asynchronous, with messages response going from minutes to days. Usually, this kind of communication is used for strategic discussions and long-term plans. That’s the reason it could be the most valuable target for an attacker.
Online Chat: Online chats are a faster way of exchanging messages. Usually, they are used when you need a quicker response from your peer, and there is no good time for a short, not planned call. Usually, the rule of thumb is to spend no more than 15 minutes chatting, and if the issue is not resolved, move to something faster. This one will be the second most significant target after the email for an attacker.
Video Conferencing: This one is the fastest. Usually, it is used to exchange a burst of already prepared information. Most of the time, the data is a tactical one, and thus this way of communication is with the lowest priority for attackers.
You can see a standard corporation infrastructure on the upper part of the diagram, where you have multiple zones and a load balancer. On the lower part is the typical small team setup, where all the data for communication is going through one cloud provider and one zone
Information Storage and Sharing
These days everything is done using information and files. But, you must store these files first and, after that, share them with your team members. Doing this using the standard communication channels is no good because there are no excellent categorization and tagging tools implemented in these systems. In short, they are not appropriately tailored for this kind of activity. That’s the reason the IT industry created a good amount of tools for solving this problem. Our small team will use them as well. So let me list them:
Project/Product Management System: Project management software (PMS) can help plan, organize, manage resource tools and develop resource estimates. Depending on the sophistication of the software, it can manage estimation and planning, scheduling, cost control, and budget management, resource allocation, collaboration software, communication, decision-making, quality management, time management, and documentation or administration systems. As you can see, most of the vital information for your project/product will be in this system, making it an excellent target for an attacker.
Cloud Storage Solution: Project management systems are outstanding in documentation storage, but they lack some of the features a full-scale cloud-based storage solution can offer. In this kind of solution, you usually store big files in a format such as video, audio, high definition graphics, etc. As such, you can leave a big part of your intellectual property lying in such cloud storage, making it a good target for an attacker.
Automation System: Especially in IT teams, sometimes your team will need automated jobs to happen. If you have automation specialists, know how to write scripts, you can automate a big part of your daily routes. In the case of programming teams, this is usually building, deploying, and testing procedures for a new version of your product/project. It means that you have to give access from your automation system to your programming code, for example. And this makes it an excellent target for an attacker.
As we already discussed in the upper paragraphs, you need at least these six types of systems working and secured to have a functional remote-first team. Coming back to our knowledge of network defenses, the ideal solution for these systems is to be defended by VPN or a similar solution and expose only port 25 of the email server to support external communication.
Unfortunately, this kind of setup will be possible only if you deploy the services in your infrastructure. In the case of cloud providers, you don’t have much control of what is exposed to the Internet and how the cloud provider takes care of your security. Plus, the infrastructure is shared between multiple organizations, and there is no guarantee that these organizations follow such strict cybersecurity rules, such as your team.
Budget
But anyway, let’s create a budget for on-premise deployment of your infrastructure, and we shall use a VPS provider because it will be cheaper for us. A virtual private server runs its copy of an operating system (OS). Customers may have super user-level access to that active system instance, so they can install almost any software that runs on that OS. For many purposes, it is functionally equivalent to a dedicated physical server and, being software-defined, can much more easily be created and configured.
The most famous VPS providers are Amazon Web Services and Microsoft Azure. Still, there are some smaller players, such as Digital Ocean and Hetzner. As we shall do the infrastructure for a small team, we shall need a VPS with a not big pool of resources and go for the lowest price, which means CX1 instance in Hentzer. So let’s list now the different servers we shall need. All the prices are per month.
Email And Chat Server(3.57$): As there will be no significant demand for these two services, we can place them on the same machine.
VPN Server(3.57$): We shall have one machine for the VPN server, and all of the services without port 25 will be behind this VPN.
GitLab Server(3.57$): Gitlab is a project management/automation system. As it can become quite a hungry beast, a standalone instance is a way to go.
Video Conferencing Server(3.57$): One more hungry beast, it is a good idea to have it as a standalone server.
Cloud Storage(9.31$): This one will be a CX1 instance + an additional 100GB to store larger files. For a small team, a total of 120GB will be enough.
With a total budget of around 23.59$ per month, we achieved a pretty good level of security. Still, a determined attacker can penetrate this setup, but it will take him more time and resources. We shall use the standard VPS provider firewall. Still, if we want to achieve a higher level of security, we could add a server that will serve as a software-based firewall and IPS solution. Additionally, there are Open Source solutions for all the services types, and they will cost us 0$ per month.
In the last article, I shared the usual disadvantages when teams use agile methods in early Start-Ups. In this part, I shall give you my list of modifications and changes over the standard agile workflows. All of them are based on my experience and errors accumulated during the years working in underfunded Start-Ups. Additionally, I shall give you additional information regarding how it can affect team morale and motivation for every modification. But let me list the different changes I used during the years:
Do not do peer reviews: Peer reviews work pretty well for improving code quality and knowledge sharing. However, they are one of the biggest bottlenecks in your team workflow. Additionally, to have productive peer reviews, the peers must usually be at the same level of expertise. The best case is for the reviewers to be with more considerable expertise than the reviewed. For early-stage Start-Ups, I would suggest senior management appoint two or three people to do all the code reviews in the company. With this approach, team morale and motivation will increase because you would avoid much friction and drama.
Avoid unit tests: Unit tests are one of the best ways to increase your code quality. However, during the early stages of your product, where you do a lot of research and expect significant refactoring of the code base, unit tests, constant maintenance can kill your velocity and hurt your team morale. Usually, after the initial effort to create the tests, the team stops maintaining them after a couple of tight deadlines, and finally, they are entirely disabled. Better spend your time doing integration, smoke, or component tests because they work on established APIs, and these APIs do not change dramatically.
On the diagram, you can see the traditional technical team structure of four layers. In early-stage Start-Ups the positions CTO, Head of Development, and Team Lead are usually held by the same person
Don’t be sloppy with your architecture: Make sure your technical architecture is solid and can be upgraded or refactored easily. Quality of code is not so important because you can improve your code quality quickly, but not your architecture. Many teams decide to start with less complex architecture, and after that, they have to reimplement the solution. Better, plan how you are going to implement your architecture in phases with change in mind. Start with only the essential components and upgrade them later. Doing something twice is the most significant morale and motivation killer in one team.
Do not estimate R&D: Early-stage Start-Ups usually must not plan research and development. It would be best to entirely avoid research and development and work on already established business or technical models with minor modifications. Innovation is expensive in terms of time and money. It should be avoided or minimized as much as possible.
Threat every task as a different sub-project: Many company owners love to categorize their products using the famous triangle of quality, speed, and time. However, the major mistake is that a software product is a collection of submodules. And every submodule comes with its complexity and implementation. It is much better to treat every submodule as a separate project and decide what we expect using the quality, speed, and time triangle.
In conclusion, these are my leading suggestions for every early-stage Start-Up team. To extend your Start-Up life, you should cut time and resources from every non-essential part. My proposed list gives some hints in that direction, and I am sure you could create your lists by filtering what the essential and not the essential activities in your team are.
