5 ms·

I'd imagine a company as big as Uber would have some sort of protection against employee's accessing customer data as well as auditing data access logs. I don't

I'd imagine a company as big as Uber would have some sort of protection against employee's accessing customer data as well as auditing data access logs. I don't think it's an inquisition per se, but rather people are tired of saying "oh well... they're a startup I can let it slide this one time"

_Codemonkeyism 9y ago
Often this only comes after IPO e.g. with SOX/... compliance.
- yeukhon 9y ago
  SOX compliance is unfortunately bureaucratic in the sense as long as you can prove control is in place no one cares if you can read customer's data. A business owner can approve thr request in some ticketing system (change ticket) then the auditor would be okay because it is not the auditor's interest to judge whether some business decision is good or bad. You can keep your private keys in a Git repo encrypted as long as you can prove control and audit logs are available because the underlying security is not an audit concern. Another example is as long as you keep data and logs for seven years, auditors would be okay; they don't care if you are keeping a yearly archive for seven rars, monthly backup for seven years, you pick. Data and security governance is often a miss item.
  - _Codemonkeyism 9y ago
    Yes.
Ductapemaster 9y ago
I'm with you there - this seems like a large oversight that should have been prevented. My original comment was more referring to all the bad press in general. I just wonder how many sketchy things modern tech companies get away with that are only discovered when the watchful eyes take notice.
- dmlittle 9y ago
  You'd be surprised. I remember talking to a co-founder of a secure, encrypted chat startup that was getting acquired by bigger startup. Their response when I asked about their encryption was that they use HTTPS instead of HTTP...

5 ms·

I'd imagine a company as big as Uber would have some sort of protection against employee's accessing customer data as well as auditing data access logs. I don't

by dmlittle 9y ago

_Codemonkeyism 9y ago
Often this only comes after IPO e.g. with SOX/... compliance.
- yeukhon 9y ago
  SOX compliance is unfortunately bureaucratic in the sense as long as you can prove control is in place no one cares if you can read customer's data. A business owner can approve thr request in some ticketing system (change ticket) then the auditor would be okay because it is not the auditor's interest to judge whether some business decision is good or bad. You can keep your private keys in a Git repo encrypted as long as you can prove control and audit logs are available because the underlying security is not an audit concern. Another example is as long as you keep data and logs for seven years, auditors would be okay; they don't care if you are keeping a yearly archive for seven rars, monthly backup for seven years, you pick. Data and security governance is often a miss item.
  - _Codemonkeyism 9y ago
    Yes.
Ductapemaster 9y ago
I'm with you there - this seems like a large oversight that should have been prevented. My original comment was more referring to all the bad press in general. I just wonder how many sketchy things modern tech companies get away with that are only discovered when the watchful eyes take notice.
- dmlittle 9y ago
  You'd be surprised. I remember talking to a co-founder of a secure, encrypted chat startup that was getting acquired by bigger startup. Their response when I asked about their encryption was that they use HTTPS instead of HTTP...