4 ms·

In this scenario, the server doesn't start out as rogue. It was an existing production machine, then superseded by an upgrade to a new set of production hardwa

by T-hawk 15y ago

In this scenario, the server doesn't start out as rogue. It was an existing production machine, then superseded by an upgrade to a new set of production hardware. You have to understand that in companies the size of "Bank of Canada", everybody is terrified of upsetting production functionality in the slightest. In almost every corporate upgrade, the old machine gets left there "just in case". And this is probably rightly so playing the probabilities of the outcomes; the small fraction of superseded machines that come back into service is still much larger than the fraction that get subverted into blackhattery. "Why did the idiot have access to them"? He's not presumed to be an idiot or bozo. He's trusted as an employee. Corps generally don't have the time or manpower or profitability incentive to spy on every action of their own personnel. You only know if somebody is a clown after the fact. "IT's job to make sure that the production environment is secure and functioning" -- IT isn't some mythical infallible entity. IT comprises human beings too, who can make mistakes or look the other way for expediency or even themselves don a black hat.

cube13 15y ago
>"Why did the idiot have access to them"? He's not presumed to be an idiot or bozo. He's trusted as an employee. Corps generally don't have the time or manpower or profitability incentive to spy on every action of their own personnel. You only know if somebody is a clown after the fact. He's implied to be a non-technical business employee. Again, why does he have access to production servers? I would understand access for developers, but business guys? They shouldn't have access beyond a web portal or something like that. So again, why did they have access to production servers? EDIT: Realistically, for a large organization like Bank of Not Canada, pushing out a new site should have several steps: 1. Management comes up with new idea, assigns peon to come up with design. 2. Peon makes content in FrontPage. 3. Peon passes content to marketing and legal(especially important, considering it's a bank). They approve it, pass it to development and IT to get it up. 4. Development and IT get it working, and put it up on production servers. None of the people in step 1, 2 or 3 should have direct access to the production servers. That means that neither the Peoon or legal or marketing department should have direct access to the production servers. If this was pushed out by a developer, I would agree that IT isn't at fault. They need that level of access to do their jobs if something goes wrong. However, this access isn't required by the peon or anyone earlier in the chain, so they should not have it. >"IT's job to make sure that the production environment is secure and functioning" -- IT isn't some mythical infallible entity. IT comprises human beings too, who can make mistakes or look the other way for expediency or even themselves don a black hat. So? That's still their job. Mistakes happen, but that isn't an excuse for making them.

by T-hawk 15y ago

cube13 15y ago

>"Why did the idiot have access to them"? He's not presumed to be an idiot or bozo. He's trusted as an employee. Corps generally don't have the time or manpower or profitability incentive to spy on every action of their own personnel. You only know if somebody is a clown after the fact. He's implied to be a non-technical business employee. Again, why does he have access to production servers? I would understand access for developers, but business guys? They shouldn't have access beyond a web portal or something like that. So again, why did they have access to production servers? EDIT: Realistically, for a large organization like Bank of Not Canada, pushing out a new site should have several steps: 1. Management comes up with new idea, assigns peon to come up with design. 2. Peon makes content in FrontPage. 3. Peon passes content to marketing and legal(especially important, considering it's a bank). They approve it, pass it to development and IT to get it up. 4. Development and IT get it working, and put it up on production servers. None of the people in step 1, 2 or 3 should have direct access to the production servers. That means that neither the Peoon or legal or marketing department should have direct access to the production servers. If this was pushed out by a developer, I would agree that IT isn't at fault. They need that level of access to do their jobs if something goes wrong. However, this access isn't required by the peon or anyone earlier in the chain, so they should not have it. >"IT's job to make sure that the production environment is secure and functioning" -- IT isn't some mythical infallible entity. IT comprises human beings too, who can make mistakes or look the other way for expediency or even themselves don a black hat. So? That's still their job. Mistakes happen, but that isn't an excuse for making them.