2 ms·

To be fair, it's not their job to educate you on good security practices. This was an obvious red flag (developers should indeed not have unfettered access to p

To be fair, it's not their job to educate you on good security practices. This was an obvious red flag (developers should indeed not have unfettered access to production databases), so if you fail at a basic separation of duties on the team, there's no point in progressing any further. If you're expecting some "detailed guidelines" so you can "fix" your system to pass their audit, you're missing the point entirely. Also when showing anything that remotely looks like customer PII, it's your job to clarify that this is not real data. Given the precedent, I can see why they thought you were being careless and showing real production data.

YeGoblynQueenne 7y ago
Wait a minute. How would they be showing production data if they couldn't access the database were, presumably, this data was stored? It sounds a lot more like the smaller company was interfacing with someone who was not technical or at the very least did not have a clear understanding of the internal processes of the big company, and expected the smaller company to have prior experience of this thing and to guide them through it. Most likely, the process would have involved the samaller company communicating with someone inside the larger company, like a DBA, and asking the large company DBA to make the changes they needed. In large financial corps, company developers are not allowed to touch the database either, in fact where I worked, we were not even allowed to create a database for testing an internal-facing project. Processes are that anal.
- celticmusic 7y ago
  > How would they be showing production data if they couldn't access the database were, presumably, this data was stored? The entire anecdote was about them telling the representative that they DO in fact have access to the production DB. Why would you expect him to act as if they didn't have access after being told they do?
  - YeGoblynQueenne 7y ago
    Oh, my mistake- sorry, I misread that.

YeGoblynQueenne 7y ago

Wait a minute. How would they be showing production data if they couldn't access the database were, presumably, this data was stored? It sounds a lot more like the smaller company was interfacing with someone who was not technical or at the very least did not have a clear understanding of the internal processes of the big company, and expected the smaller company to have prior experience of this thing and to guide them through it. Most likely, the process would have involved the samaller company communicating with someone inside the larger company, like a DBA, and asking the large company DBA to make the changes they needed. In large financial corps, company developers are not allowed to touch the database either, in fact where I worked, we were not even allowed to create a database for testing an internal-facing project. Processes are that anal.

celticmusic 7y ago
> How would they be showing production data if they couldn't access the database were, presumably, this data was stored? The entire anecdote was about them telling the representative that they DO in fact have access to the production DB. Why would you expect him to act as if they didn't have access after being told they do?
- YeGoblynQueenne 7y ago
  Oh, my mistake- sorry, I misread that.