6 ms·
That’s a really good point, reducing access would help here. If you’re a nation state with the resources of Saudi Arabia, it still wouldn’t be impossible to br
by save_ferris 6y ago
That’s a really good point, reducing access would help here.
If you’re a nation state with the resources of Saudi Arabia, it still wouldn’t be impossible to bribe or blackmail an employee who has prod access because companies don’t have much of an eye on employees private lives. They would have the resources and theoretically the incentive to really dig into the social engineering/coercion side of things. You’d be amazed how many people that make incredible salaries are in fairly significant amounts of debt. It’s pretty common in western culture, and that’s a prime opportunity for those kinds of operations.
- sneak 6y ago“prod access” should not be a single large group or access boundary. Access to non-tokenized PII data stores or the small set of systems that require touching untokenized PII should be a very small compartment, with extremely tight min-two-person deployment/introspection controls and minimal change frequency.