4 ms·
There needs to be multi-person authorization required for account spelunking. Engineer files a DB lookup request, and it must be signed by other personnel.
by TwoBit 7y ago
There needs to be multi-person authorization required for account spelunking. Engineer files a DB lookup request, and it must be signed by other personnel.
- swalsh 7y agoWon't work, people probably need to query details of accounts hundreds of times a day just in the course of daily business. Bad actors would just make the request look like another standard query. People would likely become numb to it after having to approve so many requests. I know at a previous company, we needed a business signoff, and a technical sign off on every deploy. While the technical sign off was usually painstaking, the business sign off was rubber stamped. The guy who signed off on my tickets was so overloaded, he barely even read the titles of the tickets.
- dannyw 7y agoYour processes are broken if an individual needs to query hundreds of accounts for private information a day. That is a gigantic problem in itself. Support tickets can be exempt because they’re initiated by user interaction.