Should Edtech Startups Even Bother About Security Testing?

When I started building my EdTech startup, my first thought was that security wasn't all that important. It's not like I was building a fintech product, just give users basic authentication, and we're good.

In hindsight though, I was pretty naive.

I assumed that because Edtech products don't directly lead to financial mishaps, security was a minor concern. What I overlooked was the data we would be collecting as the product grew and the potential consequences if we ever got breached.

I'm pretty sure I wasn't alone. And a number of Edtech startups might have the same view. But why? Why might Edtech startups consider security as a secondary consideration?

Why Edtech Startups Might Not Invest in Security

Regional Factors

If users aren’t willing to pay a premium for quality products, why make significant investments in security?

In developing countries like Nigeria where customers have low purchasing power, there's a limit to what you can charge for a product, or they'll find a free alternative. And if they aren't willing to pay, startups operating in these regions might decide to push security to the background. Regulations in these regions could also influence whether startups take security seriously or not.

Law enforcement isn’t usually very strict on privacy laws in developing countries, which could result in a lax attitude towards data protection.

Business Priorities

In the early stages, a startup’s goal is usually just to ship as fast as possible, which often involves cutting corners.

For an Edtech product, security might be one of those aspects that get sacrificed since there might not be any obvious major consequence like loss of customer funds. With limited resources, it can also be challenging to allocate resources for implementing strong security measures or hiring a dedicated software testing team when your main focus is user acquisition and revenue generation.

This focus on immediate business growth often overshadows the long-term importance of security.

But Why Take Security Testing Seriously?

The Internet is a Dangerous Place

Contrary to general assumptions, Edtech platforms handle extremely sensitive information.

They store student personal data and educational records, and some even store health records, many of which belong to children. Children are vulnerable, and their data falling into the hands of malicious actors is harmful. That alone is more than enough reason to take security very seriously.

Your users trust you to keep them safe, and so it is your duty to do so, regardless of how much they pay.

Interconnected Data Risks

Even if users don't lose money directly from a data breach, your product could be a weak link if it's integrated with other services, such as a financial service.

For instance, if a malicious actor gained unauthorized access to a customer's account, they could access a user's financial information. Even if they don’t get all the details required to initiate a transaction, partial information leaks still put them at risk. If customers were to lose their funds because your product was breached, you would be blamed, which could damage your reputation or even lead to legal consequences.

Remember, your users trust you with their information, so it's your duty to keep their data safe.

Regulatory Compliance

It is easy to grumble about regulations. Sometimes they feel like they're just there to make things difficult, but they aren't.

These rules are there to protect your users, especially the vulnerable ones. And since you have your users' interests at heart, you'll do your best to comply with them. And to be fair it's in also in your best interest. Ignoring compliance could result in heavy fines from law enforcement or they could impede opportunities to partner and grow with educational institutions.

So, regardless of whether law enforcement is strict with regulations in your region or not, every startup building in the Etech space should consider it a priority in their software development process.

Security Testing on a Budget

For a startup limited in resources, prioritizing security testing on top of the pressure to build and ship fast can be challenging. Limited resources include not just funds but time as well. So how can a startup do security testing without sacrificing development velocity? We’ll consider three ways:

1. Use open-source security testing tools
2. Prioritize and Automate where possible
3. Hire freelance security experts

Use Open-source Security Testing Tools

As a startup before even thinking of doing anything, your first thought should be “do we have to pay for this?”.

One open source tool you can use for security testing is OWASP ZAP. It’s a free tool that enables you to continuously monitor your web applications for vulnerabilities such as SQL injections or Cross Site Injections by simulating real-world attacks.

You could even integrate it into your development pipeline ensuring that your code is continuously being monitored as code changes are made.

This brings us to the next point: Automate where possible.

Prioritize and Automate where possible

If it can be automated, then it should be automated. True but in a smart way.

Since you’re a Startup optimizing resources, including time, you can’t do everything. This means that you need to prioritize. You can prioritize by conducting a risk assessment and identifying which features are prone to security risks. For example, your authentication system, areas of your application where you receive user input, or access to your endpoints if your app is a modular system.

Once you’ve identified those features, you can then write automation scripts for them and add them as part of your regression tests.

Hire Freelance Security Testers

Yes, I know you’re on a budget and trying to minimize expenses, so a new hire might not be what you want to hear right now.

The good news, though, is that the person would only be temporarily on your payroll, and you’d probably only have to use their services when you’re launching sensitive or critical features. You can find potential security testers on platforms like Upwork or you could leverage your existing network to find someone suitable.

Remember that while it might cost a bit upfront, it saves you time, allows your team to focus on building, and, more importantly, protects your users.

Prevention is Better Than Cure

You might not need to invest in rigorous, time-consuming security testing if you take on preventive security measures. Some of them include:

• Use cloud providers that offer built-in security features. They’ve done intense security testing on their products, which you can leverage.
• Create a Slack channel focused on security and share resources on security practices with your team and in meetings so it can be part of the minds of the team and be part of everyone's work process.
• Educate your users on the importance of security and data privacy. You can do that through occasional emails or a newsletter if you have one.

By investing in security and taking preventive measures, you’ll be protecting yourself and your users.