5 ms·

You know those complicated policies that big enterprises have, the ones startups love to mock? This is why they have them. :( You have two classes of tools...

by beat 11y ago

You know those complicated policies that big enterprises have, the ones startups love to mock? This is why they have them. :( You have two classes of tools... carrot and stick. His stick is much bigger than yours. He can destroy your company, you can sue him for it with whatever you have left after the company is destroyed. So stick is a problem. Carrots may work better... ongoing stock options, contingent on destruction of the data, certified by an expert and an oath? Basically bribe him. Yet another alternative - do you have to fire him? Why? Maybe do a Peter Principle thing, and "promote" him to a less responsible position, maybe something where he has no reason to touch production data anymore? Or start a new project, and put him in charge of it?

ocdtrekkie 11y ago
Yeah, this is the sort of thing that scares me about putting trust in signing up for a startup's service. Somewhere out there, there's a startup that has millions of user's personal information stored on a soon-to-be-disgruntled-former-employee's personal laptop. That's terrifying.
- noir_lord 11y ago
  I'm currently developing a side project that stores medical data, a big chunk of the design work I've done so far is how to work on systems where you never see production data (things like accurate faking of data, seeding correctly etc). Just yanking a copy of production to a local machine is ridiculously and horrifically common at pretty much everywhere I've worked.
  - smt88 11y ago
    You don't have to fake data in order to analyze production data safely. It is possible to anonymize personal information, although it often requires a security expert to make sure you're doing it correctly.
    - beat 11y ago
      Anonymizing PII is actually incredibly difficult. The problem is that the same things that create the valuable uniqueness you need to operate on the data are the things that are most sensitive.
    - nradov 11y ago
      There's no way to reliably anonymize medical data in the general case. PII/PHI often exists within free-text fields and file attachments. You can't remove it all just by searching and replacing.
  - beat 11y ago
    One of the inspirations for my startup is the problem of developers supporting production systems they're not allowed to actually see.
    - noir_lord 11y ago
      I think we spoke about your start up a year or so ago on here, I hope it's going well :).
      - beat 11y ago
        It's going well! Finally found a couple of co-founders, building a new version based on lessons learned from the alpha. The data model finally works the way I want it to work.
  - davelnewton 11y ago
    Enjoy the HIPAA; I know I do :(
    - noir_lord 11y ago
      I'm in the UK, different rules. Spoke to a friend in local gov who put me in touch with the right people to deal with our equivalents however so I will be compliant, in addition since users self-elect to insert their data I've got my company's legal representative looking into it as well. Medical data makes me nervous but this could help a lot of people, it's a product I'd have used immediately if it existed.
- rch 11y ago
  Bad news: big companies, governments, hospitals, etc., etc. are sharing your PII with 'data scientists' every day.
  - davelnewton 11y ago
    Unlikely hospitals are; HIPAA compliance and enforcement is an actual thing.
    - 1812Overture 11y ago
      A doctors/hospital only needs the flimsiest of "business justifications" to share/sell data to whoever they want to. What the data can be used for is limited, but it can be shared all over the place. Source: Pulling this data is part of my job.
      - davelnewton 11y ago
        There are very strict laws regarding the use of PHI. It cannot be shared "all over the place". PII/PHI is regulated to the max; if you're working for a place that pulls or uses the data from places like I work for then you guys had better be darn sure that it isn't personally identifiable, or both your place, and my place, are in for a world of hurt at the next audit.
  - ocdtrekkie 11y ago
    Yeah, I know. One thing I saw was Google soliciting hospitals for them to store DNA records there. The idea that Google could absorb thousands of people's DNA records without their permission via offering a storage service to a hospital...
- Lawtonfogle 11y ago
  Or a completely content employee who just happened to make a poor security choice at home.
- NeutronBoy 11y ago
  Yeah I don't think a lot of people understand the lengths some companies go to, to control access to their systems (either because of risk aversion, regulatory requirements, or something else). It's on a different planet from a startup mentality of 'We hire trustworthy people, so all 10 employees have access to prod'. This is 'How do we protect customer data from 1 in 2000 IT staff across 100 countries?' For example, I was working at a massive bank that was implementing an access control system for their servers that meant that admin's didn't have direct access. You had to - submit a change ticket that went through all the approvals. - This triggered a workflow through a web interface that opened an RDP or text terminal session to the server, for the appropriate person (OS, application, database, etc) - The RDP session was recorded to video, the text session was logged. - Once you logged out the password on the server was auto-rotated. - The text-session was indexed and searchable. The software coordinating all this was able to match server logs against the video RDP session so you could search through the video ("show me the SQL Server commands that admin ran") - On a regular basis, the server state would be reconciled against all the logged tickets for that server and discrepancies investigated.
  - anon987 11y ago
    Please, PLEASE tell us the name of this place so we never have to work there.
    - NeutronBoy 11y ago
      It's called "Most Big Financial Companies" This was the result of a huge case of risk aversion and response to very loose but firm regulatory requirements. I agree there's a middle-ground, but it's not "Employees can use their personal laptops".
    - pm24601 11y ago
      Why would you care? Most devs have no business with admin access to production servers. Note: this is different than being able to deploy new code, I am talking about messing with a box in a data center
    - raphar 11y ago
scrumper 11y ago
Retaining him - rewarding him, even - in contravention of company policy seems to create a great deal of liability for the firm if there is any PII leakage. "My client's personal data was stolen from your firm, and we found that you have this employee, who had the client database on his home laptop, but you didn't fire him? Here's a lawsuit."
- beat 11y ago
  On the other hand, retaining him long enough to implement a policy and start enforcing it - and enforcing it on him - might be a good idea.
  - basch 11y ago
    hey, id like to fire you, but you have sensitive information on your laptop, so instead im promoting you to the position of data security, and your job is to create and enforce policies so i never get in this situation again. consider yourself lucky.
    - csorrell 11y ago
      Sounds like a dilbert cartoon!

by beat 11y ago

ocdtrekkie 11y ago

Yeah, this is the sort of thing that scares me about putting trust in signing up for a startup's service. Somewhere out there, there's a startup that has millions of user's personal information stored on a soon-to-be-disgruntled-former-employee's personal laptop. That's terrifying.

noir_lord 11y ago
I'm currently developing a side project that stores medical data, a big chunk of the design work I've done so far is how to work on systems where you never see production data (things like accurate faking of data, seeding correctly etc). Just yanking a copy of production to a local machine is ridiculously and horrifically common at pretty much everywhere I've worked.
- smt88 11y ago
  You don't have to fake data in order to analyze production data safely. It is possible to anonymize personal information, although it often requires a security expert to make sure you're doing it correctly.
  - beat 11y ago
    Anonymizing PII is actually incredibly difficult. The problem is that the same things that create the valuable uniqueness you need to operate on the data are the things that are most sensitive.
  - nradov 11y ago
    There's no way to reliably anonymize medical data in the general case. PII/PHI often exists within free-text fields and file attachments. You can't remove it all just by searching and replacing.
- beat 11y ago
  One of the inspirations for my startup is the problem of developers supporting production systems they're not allowed to actually see.
  - noir_lord 11y ago
    I think we spoke about your start up a year or so ago on here, I hope it's going well :).
    - beat 11y ago
      It's going well! Finally found a couple of co-founders, building a new version based on lessons learned from the alpha. The data model finally works the way I want it to work.
- davelnewton 11y ago
  Enjoy the HIPAA; I know I do :(
  - noir_lord 11y ago
    I'm in the UK, different rules. Spoke to a friend in local gov who put me in touch with the right people to deal with our equivalents however so I will be compliant, in addition since users self-elect to insert their data I've got my company's legal representative looking into it as well. Medical data makes me nervous but this could help a lot of people, it's a product I'd have used immediately if it existed.
rch 11y ago
Bad news: big companies, governments, hospitals, etc., etc. are sharing your PII with 'data scientists' every day.
- davelnewton 11y ago
  Unlikely hospitals are; HIPAA compliance and enforcement is an actual thing.
  - 1812Overture 11y ago
    A doctors/hospital only needs the flimsiest of "business justifications" to share/sell data to whoever they want to. What the data can be used for is limited, but it can be shared all over the place. Source: Pulling this data is part of my job.
    - davelnewton 11y ago
      There are very strict laws regarding the use of PHI. It cannot be shared "all over the place". PII/PHI is regulated to the max; if you're working for a place that pulls or uses the data from places like I work for then you guys had better be darn sure that it isn't personally identifiable, or both your place, and my place, are in for a world of hurt at the next audit.
- ocdtrekkie 11y ago
  Yeah, I know. One thing I saw was Google soliciting hospitals for them to store DNA records there. The idea that Google could absorb thousands of people's DNA records without their permission via offering a storage service to a hospital...
Lawtonfogle 11y ago
Or a completely content employee who just happened to make a poor security choice at home.
NeutronBoy 11y ago
Yeah I don't think a lot of people understand the lengths some companies go to, to control access to their systems (either because of risk aversion, regulatory requirements, or something else). It's on a different planet from a startup mentality of 'We hire trustworthy people, so all 10 employees have access to prod'. This is 'How do we protect customer data from 1 in 2000 IT staff across 100 countries?' For example, I was working at a massive bank that was implementing an access control system for their servers that meant that admin's didn't have direct access. You had to - submit a change ticket that went through all the approvals. - This triggered a workflow through a web interface that opened an RDP or text terminal session to the server, for the appropriate person (OS, application, database, etc) - The RDP session was recorded to video, the text session was logged. - Once you logged out the password on the server was auto-rotated. - The text-session was indexed and searchable. The software coordinating all this was able to match server logs against the video RDP session so you could search through the video ("show me the SQL Server commands that admin ran") - On a regular basis, the server state would be reconciled against all the logged tickets for that server and discrepancies investigated.
- anon987 11y ago
  Please, PLEASE tell us the name of this place so we never have to work there.
  - NeutronBoy 11y ago
    It's called "Most Big Financial Companies" This was the result of a huge case of risk aversion and response to very loose but firm regulatory requirements. I agree there's a middle-ground, but it's not "Employees can use their personal laptops".
  - pm24601 11y ago
    Why would you care? Most devs have no business with admin access to production servers. Note: this is different than being able to deploy new code, I am talking about messing with a box in a data center
  - raphar 11y ago

scrumper 11y ago

Retaining him - rewarding him, even - in contravention of company policy seems to create a great deal of liability for the firm if there is any PII leakage. "My client's personal data was stolen from your firm, and we found that you have this employee, who had the client database on his home laptop, but you didn't fire him? Here's a lawsuit."

beat 11y ago
On the other hand, retaining him long enough to implement a policy and start enforcing it - and enforcing it on him - might be a good idea.
- basch 11y ago
  hey, id like to fire you, but you have sensitive information on your laptop, so instead im promoting you to the position of data security, and your job is to create and enforce policies so i never get in this situation again. consider yourself lucky.
  - csorrell 11y ago
    Sounds like a dilbert cartoon!