2 ms·

If you are interested in a list of steps you can take to avoid this happening to your data, here are some suggestions. I don't believe that any single measure i

If you are interested in a list of steps you can take to avoid this happening to your data, here are some suggestions. I don't believe that any single measure is sufficient. And I also believe that it's valid to balance the strictness of your controls against the the amount of protection you really need. 1. Vault the passwords. People and machines should fetch passwords on-demand using identity credentials. 2. Create a read-only database account. In all cases, use the account that matches the need. Running reports? Use the read-only account. 3. Restrict access to read-only and read-write database accounts. Provide this account information to a limited set of people and tools. 4. Provide a fairly straightforward way for people to get temporary elevated access. If it's easy to get elevated access, then users will not be tempted to "hold on" to elevated access longer than they should (e.g. by leaving a terminal open for a very long time). 5. Rotate the credentials of all the accounts regularly. This ensures that temporary elevated access will become long-term access. It also greatly reduces the harm created when credentials are leaked, exposed, or forgotten about (e.g. in an environment variable in an old window). Note that none of the steps above require a heavy investment in automation. You can start with basic (even fully manual) processes for key management and access management, and evolve to automation as you grow. Finally, keep in mind that this type of accident is not just a "small company" problem. Recall this AWS ELB outage on Christmas Eve of 2012 - https://aws.amazon.com/message/680587/ https://aws.amazon.com/message/680587/ "The data was deleted by a maintenance process that was inadvertently run against the production ELB state data."

twic 9y ago
> 4. Provide a fairly straightforward way for people to get temporary elevated access. If it's easy to get elevated access, then users will not be tempted to "hold on" to elevated access longer than they should (e.g. by leaving a terminal open for a very long time). Or to hack around it in some other way, eg by adding some sort of backdoor to a production application. This is such an important lesson, and one that unfortunately is lost on many command-and-control type IT departments.

twic 9y ago

> 4. Provide a fairly straightforward way for people to get temporary elevated access. If it's easy to get elevated access, then users will not be tempted to "hold on" to elevated access longer than they should (e.g. by leaving a terminal open for a very long time). Or to hack around it in some other way, eg by adding some sort of backdoor to a production application. This is such an important lesson, and one that unfortunately is lost on many command-and-control type IT departments.