3 ms·

It's extremely expensive. Many banks and companies in the finance industry (hedge funds) do this: Hire at least 2 or 3 people for every job. Have them watch

It's extremely expensive. Many banks and companies in the finance industry (hedge funds) do this: Hire at least 2 or 3 people for every job. Have them watch each other whenever touching systems that connect to production or deploying code to production. Never trust any one of them with the private keys or passwords to anything - they can only get half of a secret and their co-worker gets the other half. To do this effectively, you have to build a zero trust environment, and rely on surveillance to ensure that nobody is a bad actor. It really makes CIA/NSA level security look somewhat weak. It's also very expensive, as you can imagine.

rodgerd 11y ago
> Hire at least 2 or 3 people for every job. This is actually the key one - the more people who need to be corrupt, the harder it is to get away with being a crook. A surprising amount of internal fraud can be completed simply by requiring people to take solid blocks (2 weeks plus) of leave every year. That "inefficiency" the "lean 10x disruptors" congratulate themselves over does not always end well.
- thedudemabry 11y ago
  I've kinda thought about this in the context of relatively complex technical jobs. One side of my family tree worked a bunch in the consumer banking (non-investment) industry, and I remember hearing story after story of someone being caught after their mandatory leave. But at a job where the ideal is automation, rather than manual verification and analysis, I wonder what additional obstacles must be placed in a potential attacker's way? Rotating keys based on employee schedules? I'm sure there are many well-studied ways to do this, but it's interesting to armchair analyze.
- Terr_ 11y ago
  > solid blocks (2 weeks plus) of leave I've heard that's because a lot of those scams/tricks fall apart without constant gradual intervention, so an important part of it is that the employee is prevented from accessing most work-resources during that time.

rodgerd 11y ago

> Hire at least 2 or 3 people for every job. This is actually the key one - the more people who need to be corrupt, the harder it is to get away with being a crook. A surprising amount of internal fraud can be completed simply by requiring people to take solid blocks (2 weeks plus) of leave every year. That "inefficiency" the "lean 10x disruptors" congratulate themselves over does not always end well.

thedudemabry 11y ago
I've kinda thought about this in the context of relatively complex technical jobs. One side of my family tree worked a bunch in the consumer banking (non-investment) industry, and I remember hearing story after story of someone being caught after their mandatory leave. But at a job where the ideal is automation, rather than manual verification and analysis, I wonder what additional obstacles must be placed in a potential attacker's way? Rotating keys based on employee schedules? I'm sure there are many well-studied ways to do this, but it's interesting to armchair analyze.
Terr_ 11y ago
> solid blocks (2 weeks plus) of leave I've heard that's because a lot of those scams/tricks fall apart without constant gradual intervention, so an important part of it is that the employee is prevented from accessing most work-resources during that time.