>"Why did the idiot have access to them"? He's not presumed to be an idiot or bozo. He's trusted as an employee. Corps generally don't have the time or manpower

>"Why did the idiot have access to them"? He's not presumed to be an idiot or bozo. He's trusted as an employee. Corps generally don't have the time or manpower or profitability incentive to spy on every action of their own personnel. You only know if somebody is a clown after the fact. He's implied to be a non-technical business employee. Again, why does he have access to production servers? I would understand access for developers, but business guys? They shouldn't have access beyond a web portal or something like that. So again, why did they have access to production servers? EDIT: Realistically, for a large organization like Bank of Not Canada, pushing out a new site should have several steps: 1. Management comes up with new idea, assigns peon to come up with design. 2. Peon makes content in FrontPage. 3. Peon passes content to marketing and legal(especially important, considering it's a bank). They approve it, pass it to development and IT to get it up. 4. Development and IT get it working, and put it up on production servers. None of the people in step 1, 2 or 3 should have direct access to the production servers. That means that neither the Peoon or legal or marketing department should have direct access to the production servers. If this was pushed out by a developer, I would agree that IT isn't at fault. They need that level of access to do their jobs if something goes wrong. However, this access isn't required by the peon or anyone earlier in the chain, so they should not have it. >"IT's job to make sure that the production environment is secure and functioning" -- IT isn't some mythical infallible entity. IT comprises human beings too, who can make mistakes or look the other way for expediency or even themselves don a black hat. So? That's still their job. Mistakes happen, but that isn't an excuse for making them.