3 ms·

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. I couldn't disagree more. Eventually, you're going to hi

by x0x0 9y ago

> Basically, I think its reasonable to both allow many people access and expect them to not abuse it. I couldn't disagree more. Eventually, you're going to hire an idiot (and/or budding rapist). When you have PII of this nature, if you're going to allow lots of people access, you need individual access controls, logging, and most importantly, auditing of the aforementioned data. And auditing may not be enough; you probably need individual inspection and approval to eg look up user info not tied to a ticket you're processing. Particularly after seeing the Uber god view scandal, there's just no excuse not to have this basic stuff in place. I worked for a much much smaller startup handling data that was significantly harder to tie to a actual person and we did the above.

walshemj 9y ago
I remember a briefing when I worked for BT in the UK some one looked up for a mate his exes new address - who then got murdered. There was also the case involving hit men who found the address of a targets mom and dad who where also killed by bribing some one. BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did.
- chipperyman573 9y ago
  >BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did. I would rather be "dealt with" by BT than with the cops or secret service. BT can fire you, the cops and SS can take away your rights (with due process)
  - walshemj 9y ago
    As a former PTT IB or SD was descended from the unit in the GPO that dealt with stealing for the post so had some odd quasi legal standing - its also where the secret squirrels worked. They have a bad reputation as in the bad old days some of the confessions involved falling down stairs, which I was hinting at :-)

by x0x0 9y ago

walshemj 9y ago

I remember a briefing when I worked for BT in the UK some one looked up for a mate his exes new address - who then got murdered. There was also the case involving hit men who found the address of a targets mom and dad who where also killed by bribing some one. BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did.

chipperyman573 9y ago
>BT took security v seriously and you had better hope if you did something bad that the cops or the even the secret service (MI5) got to you before the internal security team did. I would rather be "dealt with" by BT than with the cops or secret service. BT can fire you, the cops and SS can take away your rights (with due process)
- walshemj 9y ago
  As a former PTT IB or SD was descended from the unit in the GPO that dealt with stealing for the post so had some odd quasi legal standing - its also where the secret squirrels worked. They have a bad reputation as in the bad old days some of the confessions involved falling down stairs, which I was hinting at :-)