4 ms·
Has anyone worked at a company where Change Management was so good that there was no possible backdoor? Every system change would have to be approved by at leas
by zimbatm 8y ago
Has anyone worked at a company where Change Management was so good that there was no possible backdoor? Every system change would have to be approved by at least one other engineer and there is no ssh/sudo access on production systems?
So far my impression is that all that is required is to gain access to Jenkins one way or another and you have the keys of the whole infrastructure.
- knorker 8y agoThere's never no possible backdoor, but yes I think in order to effectively do this and not involve my whole company like the article described you may have to have to involve Intel (and AMD is coming back, so them too) to go all "trusting trust" on this problem. And even then people may notice that their FDO profiles seem to be broken, and other "huh, that's funny". Also other shops that actually obey SOX, and actually care about two-key systems (or multi-key) will not be able to keep this a secret. The same protections that work for SOX and "sysadmins kid was kidnapped and they demand a backdoor be inserted" will work for this. Sure, companies that protect against none of these will fail. But if you actually have systems in place to protect against "rogue employee" then this kind of order requires breaking ALL of these systems. I expect most companies to have no such systems, but the important ones do.