5 ms·

Yeah I don't think a lot of people understand the lengths some companies go to, to control access to their systems (either because of risk aversion, regulatory

Yeah I don't think a lot of people understand the lengths some companies go to, to control access to their systems (either because of risk aversion, regulatory requirements, or something else). It's on a different planet from a startup mentality of 'We hire trustworthy people, so all 10 employees have access to prod'. This is 'How do we protect customer data from 1 in 2000 IT staff across 100 countries?' For example, I was working at a massive bank that was implementing an access control system for their servers that meant that admin's didn't have direct access. You had to - submit a change ticket that went through all the approvals. - This triggered a workflow through a web interface that opened an RDP or text terminal session to the server, for the appropriate person (OS, application, database, etc) - The RDP session was recorded to video, the text session was logged. - Once you logged out the password on the server was auto-rotated. - The text-session was indexed and searchable. The software coordinating all this was able to match server logs against the video RDP session so you could search through the video ("show me the SQL Server commands that admin ran") - On a regular basis, the server state would be reconciled against all the logged tickets for that server and discrepancies investigated.

anon987 11y ago
Please, PLEASE tell us the name of this place so we never have to work there.
- NeutronBoy 11y ago
  It's called "Most Big Financial Companies" This was the result of a huge case of risk aversion and response to very loose but firm regulatory requirements. I agree there's a middle-ground, but it's not "Employees can use their personal laptops".
- pm24601 11y ago
  Why would you care? Most devs have no business with admin access to production servers. Note: this is different than being able to deploy new code, I am talking about messing with a box in a data center
- raphar 11y ago
  Almost every bank. My country assign a category to every bank. One of the requirements to earn a better category is the AUDITED production environment and its processes. a better category enables the institution to access bigger, riskier and more profitable business. That is: production environment practices affects business directly. My employer has an ITIL system on place, and that is the only way to touch prod. It is not for everyone, I admit!

anon987 11y ago

Please, PLEASE tell us the name of this place so we never have to work there.

NeutronBoy 11y ago
It's called "Most Big Financial Companies" This was the result of a huge case of risk aversion and response to very loose but firm regulatory requirements. I agree there's a middle-ground, but it's not "Employees can use their personal laptops".
pm24601 11y ago
Why would you care? Most devs have no business with admin access to production servers. Note: this is different than being able to deploy new code, I am talking about messing with a box in a data center
raphar 11y ago
Almost every bank. My country assign a category to every bank. One of the requirements to earn a better category is the AUDITED production environment and its processes. a better category enables the institution to access bigger, riskier and more profitable business. That is: production environment practices affects business directly. My employer has an ITIL system on place, and that is the only way to touch prod. It is not for everyone, I admit!