7 ms·

This highlights more than ever that whatever customer data your employees have access to, you need to log every single access to it, and have automatic audits-

by mabbo 6y ago

This highlights more than ever that whatever customer data your employees have access to, you need to log every single access to it, and have automatic audits- who should be accessing what? What accesses are surprising? Seems like something one could build a SaaS business around- send them reports that <user> accessed <fields> about <customer ID> on <date>, along with a copy of attributes and roles about each user. Service could offer deep dives, querying, reporting, along with ML or rule-based flagging to say "That seems odd". If Twitter can't build the infrastructure needed to do that, I can't imagine how few small companies can do it themselves either.

dathinab 6y ago
It already exists it part of the process mining+ monitoring box. This kind of system are already used to both optimize business processes and conformance check then by organizations like banks and hospitals. Through tools are currently focused mainly on the use case for process optimization and regulation conformance checking less so for irregularity detection but tools like that exists to. I think to remember SAP has some form of self learning/calibrating irregularity detection "service"/tool. So it's less about creating it then about spending Mony on it and from scratch up analysing your internal thread model. It's quite expensive, some of this software is sold for higher 5 digit numbers even for "small" use-cases.
- mabbo 6y ago
  > It's quite expensive, some of this software is sold for higher 5 digit numbers even for "small" use-cases. "Your margin is my opportunity" - Jeff Bezos A simple version of this could be done cheaply, and not cost much. API to push events, website to host reports, pay-for-use add-ons for alerts, etc.
  - tmpz22 6y ago
    You're misidentifying the real problem which is not in the software itself. The real problem is that data needs to be accessed by marketing, analytics, sales, executive, HR, and other parts of the company all the time. It's a human problem managing the impedance of data access blocks... and guess what at most companies the block is seen as a significant cost far greater then the "cost" of PII violations, leaks, or hacks... But go ahead and find a random group of 3 ex-googlers with no domain experience to raise ~$2MM and chase it anyways. Then when you burn through the money you can go back to your FANNG job with a nice raise.
  - toomuchtodo 6y ago
    Bolting tools on to an org doesn't fix its culture.
  - tjalfi 6y ago
    Part of my job is to support a system that enforces ethical walls[0]. Here are some of the reasons why this niche isn't a good fit for a low margin business: These products are complex and require extensive customization to be useful. It's common to require consulting when installing or upgrading them. Third-party integrations are common; the product that I support integrates with at least 3 third-party services. The service is valuable to these organizations and they are willing to pay fairly high fees for using it. Why leave money on the table? Support costs are high due to the complexity of the customer's environment. [0] https://en.wikipedia.org/wiki/Chinese_wall https://en.wikipedia.org/wiki/Chinese_wall
sneak 6y ago
I wonder if tokenizing all PII for storage, with a special lookup server accessible only to a small group, would reduce the threat of these kinds of attacks. Obviously some things like SMS or sending of email need to manipulate this data, but rx/tx of eg sms given a placeholder token could also be similarly siloed, so most technical staff would never have or need access to raw PII like IP, phone, or email. Unfortunately geolocation for ad targeting and other customization features is still probably going to make a “what country is this user in right now?” possible for most devs/SREs, which is itself a bit of a physical location change traffic leak, but making it near-impossible for most devs or SREs to view untokenized user PII would probably be a huge step in the right direction.
kitteh 6y ago
Telcos have this level of monitoring of accounts because employees routinely would abuse this access to find details of exs, family members, friends and celebrities (billing info, call detail records, etc.). The problem was there was no proactive monitoring - it was all reaction based upon complaints that would kick off the investigation. I asked why this wasn't automatic to detect clear abuse and the answer was "do you know how many people we'd have to fire if we went looking for abuse?".
- Red_Leaves_Flyy 6y ago
  If they're abusing their position they don't deserve to keep their job. The companies complicity makes them party to whatever these staff do. Whether a lawyer can prove that or not depends on the depth of the aggrieveds bank account.
  - mc32 6y ago
    The same problem existed in patient data prior to HIPAA. It still happens, but the unauthorized disclosures have gone down due to automated trips. It used to be your check in clerk could run any reports on whomever they wanted without giving it a second thought.
  - ticmasta 6y ago
    So when I worked for the cable company straight out of uni and we would look up famous local people to see what packages they subscribed to, we should have all been fired? I guess technically, but that's pretty draconian. Are you also no mercy, hard on crime, 1-strike and you're out person, or more progressive in that area?
    - neolog 6y ago
      Would you have done it if you knew you would definitely get caught and be fired immediately?
    - dboreham 6y ago
      > we should have all been fired? Yes.
paulpan 6y ago
My thoughts exactly, though it seems the incident happened a few years ago when the mentality of "move fast and break things" mentality was much more acceptable. I'd be very concerned if there still aren't processes and technical barriers to prevent the majority employees from accessing user data. IP address, phone number, etc. should require top-level authorization to access - not something an engineer or even marketing/sales person can just look up.
- nitrogen 6y ago
  a few years ago Twitter was hacked via social engineering of an employee just last month: https://news.ycombinator.com/item?id=23851275 https://news.ycombinator.com/item?id=23851275
evgen 6y ago
For quite a long time (and probably still today but I have no idea) there was at least as much monitoring and security infrastructure built around watching and auditing what Facebook employees did to data as there was around what third-parties might be trying to do to Facebook infra and corp networks.
kbash9 6y ago
Yes, full role-based access control and audibility is key. This also highlights the need for data masking built into these DB systems. If data is gold, you need vaults to protect it.
dylan604 6y ago
>Seems like something one could build a SaaS business around- send them reports that <user> accessed <fields> about <customer ID> on <date>, along with a copy of attributes and roles about each user. Service could offer deep dives, querying, reporting, along with ML or rule-based flagging to say "That seems odd". Wouldn't that just expose user data to an even wider group of people while doing this reporting?
- Xavdidtheshadow 6y ago
  If I'm following the suggestion, then it's just logs which keys were accessed: "employee id 1234 accessed "email, password hash, location, birthday" about customer id 6789 on 2020-09-01" nothing particularly sensitive in there, but makes it easy to audit and check for abnormalities.
  - dylan604 6y ago
    Nothing sensitive about what you just described? Seems like with that info you can start making intelligent answers to security questions or possible rainbow table look ups.
    - wizzwizz4 6y ago
      It's the column headings, though.
      - dylan604 6y ago
        Ahhh, I'm a dolt. I read that as variables in your comment rather than that is literally the data that is returned. Thanks for clarifying
        Xavdidtheshadow 6y ago
        Doesn't look like I can edit, but I could have been more clear

by mabbo 6y ago

dathinab 6y ago

It already exists it part of the process mining+ monitoring box. This kind of system are already used to both optimize business processes and conformance check then by organizations like banks and hospitals. Through tools are currently focused mainly on the use case for process optimization and regulation conformance checking less so for irregularity detection but tools like that exists to. I think to remember SAP has some form of self learning/calibrating irregularity detection "service"/tool. So it's less about creating it then about spending Mony on it and from scratch up analysing your internal thread model. It's quite expensive, some of this software is sold for higher 5 digit numbers even for "small" use-cases.

mabbo 6y ago
> It's quite expensive, some of this software is sold for higher 5 digit numbers even for "small" use-cases. "Your margin is my opportunity" - Jeff Bezos A simple version of this could be done cheaply, and not cost much. API to push events, website to host reports, pay-for-use add-ons for alerts, etc.
- tmpz22 6y ago
  You're misidentifying the real problem which is not in the software itself. The real problem is that data needs to be accessed by marketing, analytics, sales, executive, HR, and other parts of the company all the time. It's a human problem managing the impedance of data access blocks... and guess what at most companies the block is seen as a significant cost far greater then the "cost" of PII violations, leaks, or hacks... But go ahead and find a random group of 3 ex-googlers with no domain experience to raise ~$2MM and chase it anyways. Then when you burn through the money you can go back to your FANNG job with a nice raise.
- toomuchtodo 6y ago
  Bolting tools on to an org doesn't fix its culture.
- tjalfi 6y ago
  Part of my job is to support a system that enforces ethical walls[0]. Here are some of the reasons why this niche isn't a good fit for a low margin business: These products are complex and require extensive customization to be useful. It's common to require consulting when installing or upgrading them. Third-party integrations are common; the product that I support integrates with at least 3 third-party services. The service is valuable to these organizations and they are willing to pay fairly high fees for using it. Why leave money on the table? Support costs are high due to the complexity of the customer's environment. [0] https://en.wikipedia.org/wiki/Chinese_wall https://en.wikipedia.org/wiki/Chinese_wall

sneak 6y ago

I wonder if tokenizing all PII for storage, with a special lookup server accessible only to a small group, would reduce the threat of these kinds of attacks. Obviously some things like SMS or sending of email need to manipulate this data, but rx/tx of eg sms given a placeholder token could also be similarly siloed, so most technical staff would never have or need access to raw PII like IP, phone, or email. Unfortunately geolocation for ad targeting and other customization features is still probably going to make a “what country is this user in right now?” possible for most devs/SREs, which is itself a bit of a physical location change traffic leak, but making it near-impossible for most devs or SREs to view untokenized user PII would probably be a huge step in the right direction.

kitteh 6y ago

Telcos have this level of monitoring of accounts because employees routinely would abuse this access to find details of exs, family members, friends and celebrities (billing info, call detail records, etc.). The problem was there was no proactive monitoring - it was all reaction based upon complaints that would kick off the investigation. I asked why this wasn't automatic to detect clear abuse and the answer was "do you know how many people we'd have to fire if we went looking for abuse?".

Red_Leaves_Flyy 6y ago
If they're abusing their position they don't deserve to keep their job. The companies complicity makes them party to whatever these staff do. Whether a lawyer can prove that or not depends on the depth of the aggrieveds bank account.
- mc32 6y ago
  The same problem existed in patient data prior to HIPAA. It still happens, but the unauthorized disclosures have gone down due to automated trips. It used to be your check in clerk could run any reports on whomever they wanted without giving it a second thought.
- ticmasta 6y ago
  So when I worked for the cable company straight out of uni and we would look up famous local people to see what packages they subscribed to, we should have all been fired? I guess technically, but that's pretty draconian. Are you also no mercy, hard on crime, 1-strike and you're out person, or more progressive in that area?
  - neolog 6y ago
    Would you have done it if you knew you would definitely get caught and be fired immediately?
  - dboreham 6y ago
    > we should have all been fired? Yes.

paulpan 6y ago

My thoughts exactly, though it seems the incident happened a few years ago when the mentality of "move fast and break things" mentality was much more acceptable. I'd be very concerned if there still aren't processes and technical barriers to prevent the majority employees from accessing user data. IP address, phone number, etc. should require top-level authorization to access - not something an engineer or even marketing/sales person can just look up.

nitrogen 6y ago
a few years ago Twitter was hacked via social engineering of an employee just last month: https://news.ycombinator.com/item?id=23851275 https://news.ycombinator.com/item?id=23851275

evgen 6y ago

For quite a long time (and probably still today but I have no idea) there was at least as much monitoring and security infrastructure built around watching and auditing what Facebook employees did to data as there was around what third-parties might be trying to do to Facebook infra and corp networks.

kbash9 6y ago

Yes, full role-based access control and audibility is key. This also highlights the need for data masking built into these DB systems. If data is gold, you need vaults to protect it.

dylan604 6y ago

>Seems like something one could build a SaaS business around- send them reports that <user> accessed <fields> about <customer ID> on <date>, along with a copy of attributes and roles about each user. Service could offer deep dives, querying, reporting, along with ML or rule-based flagging to say "That seems odd". Wouldn't that just expose user data to an even wider group of people while doing this reporting?

Xavdidtheshadow 6y ago
If I'm following the suggestion, then it's just logs which keys were accessed: "employee id 1234 accessed "email, password hash, location, birthday" about customer id 6789 on 2020-09-01" nothing particularly sensitive in there, but makes it easy to audit and check for abnormalities.
- dylan604 6y ago
  Nothing sensitive about what you just described? Seems like with that info you can start making intelligent answers to security questions or possible rainbow table look ups.
  - wizzwizz4 6y ago
    It's the column headings, though.
    - dylan604 6y ago
      Ahhh, I'm a dolt. I read that as variables in your comment rather than that is literally the data that is returned. Thanks for clarifying
      - Xavdidtheshadow 6y ago
        Doesn't look like I can edit, but I could have been more clear