8 ms·

If I were to ask my CISO if I was allowed to bring the production database home, I’m pretty sure his answer wouldn’t be “as long as you encrypt it”.

sneak 6y ago
Once you're big enough to afford a CISO, you're likely big enough to afford office space with decent physical security to serve as a third replicated database site to complement your two datacenters. These solutions are not one-size-fits-all. What works for a small startup isn't appropriate for a 100+ person company.
- AmericanChopper 6y ago
  Yes, I agree. Small companies typically are very bad at security.
  - sneak 6y ago
    I am really good at security and I too keep encrypted backups on-site in my house.
  - _joel 6y ago
    Not in my experience. Worked at some small shops that were lightyears ahead in terms of policy, procedures and attitude compared to places I've worked with 50k+ employees globally.
    - AmericanChopper 6y ago
      Large organisations tend not to achieve security compliance with overly sophisticated systems of policy and controls. They tend to do it using bureaucracy, which while usually rather effective at implementing the level of control required, will typically leave a lot to be desired in regards to UX and productivity. Small organisations tend to ignore the topic entirely until they encounter a prospective client or regulatory barrier that demands it. At which point they may initially implement some highly elegant systems. Until they grow large enough that they all devolve into bureaucratic mazes.
      - _joel 6y ago
        I'm aware, but that's not been my experience. I've been in large places where there's been a lassiez faire attitude because it was "another team's job" and general bikeshedding over smaller features because the bigger picture security wasn't their area or was forced from a dictat from above to use X because they're on the board, whilst X is completely unfit for purpose. There's no pushback. However I've worked at small ISPs where we took security extremely seriously. Appropriate background check and industry policy but moreso the attitude... we wanted to offer customers security because we had pride in our work.
croon 6y ago
Well, it's not because the encryption is insecure.
brmgb 6y ago
That's because he doesn't trust you with this data. That has nothing to do with encryption safety. There is nothing magical about data centers making them safe while your local copy isn't.
- AmericanChopper 6y ago
  > There is nothing magical about data centers making them safe while your local copy isn't. Is this a serious comment? My house is not certified as being compliant with any security standards. Here's the list that the 3rd party datacenter we use is certified as complaint with: https://aws.amazon.com/compliance/programs/ https://aws.amazon.com/compliance/programs/ The data centers we operate ourselves are audited against several of those standards too. I guess you're right that there's nothing magic about security controls, but it has nothing to do with trust. Sensitive data should generally never leave a secure facility, outside of particularly controlled circumstances.
  - brmgb 6y ago
    Of course it's serious. You are entierly missing the point by quoting the compliance programs followed by AWS whose sole business is being a third party hoster. For most business, what you call sensitive data is customers and orders listing, payment history, inventory if you are dealing in physical goods and HR related files. These are not state secrets. Encryption and a modicum of physical security go a long way. I personally find the idea that you shouldn't store a local backup of this kind of data out of security concern entirely laughable. But that's me.
    - AmericanChopper 6y ago
      This is quite a significant revision to your previous statement that there’s nothing about a data center that makes it more secure than your house. This attitude that your data isn’t very important, so it’s fine to not be very concerned about it’s security, while not entirely uncommon, is something most organisations try to avoid when choosing vendors. It’s something consumers are generally unconcerned about, until a breach occurs, and The Intercept write an article about it. At which point I’m sure all the people ITT who are saying it’s fine to take your production database home would be piling on with how stupid the company was for doing ridiculous things like taking a copy of their production database home.

sneak 6y ago

Once you're big enough to afford a CISO, you're likely big enough to afford office space with decent physical security to serve as a third replicated database site to complement your two datacenters. These solutions are not one-size-fits-all. What works for a small startup isn't appropriate for a 100+ person company.

AmericanChopper 6y ago
Yes, I agree. Small companies typically are very bad at security.
- sneak 6y ago
  I am really good at security and I too keep encrypted backups on-site in my house.
- _joel 6y ago
  Not in my experience. Worked at some small shops that were lightyears ahead in terms of policy, procedures and attitude compared to places I've worked with 50k+ employees globally.
  - AmericanChopper 6y ago
    Large organisations tend not to achieve security compliance with overly sophisticated systems of policy and controls. They tend to do it using bureaucracy, which while usually rather effective at implementing the level of control required, will typically leave a lot to be desired in regards to UX and productivity. Small organisations tend to ignore the topic entirely until they encounter a prospective client or regulatory barrier that demands it. At which point they may initially implement some highly elegant systems. Until they grow large enough that they all devolve into bureaucratic mazes.
    - _joel 6y ago
      I'm aware, but that's not been my experience. I've been in large places where there's been a lassiez faire attitude because it was "another team's job" and general bikeshedding over smaller features because the bigger picture security wasn't their area or was forced from a dictat from above to use X because they're on the board, whilst X is completely unfit for purpose. There's no pushback. However I've worked at small ISPs where we took security extremely seriously. Appropriate background check and industry policy but moreso the attitude... we wanted to offer customers security because we had pride in our work.

croon 6y ago

Well, it's not because the encryption is insecure.

brmgb 6y ago

That's because he doesn't trust you with this data. That has nothing to do with encryption safety. There is nothing magical about data centers making them safe while your local copy isn't.

AmericanChopper 6y ago
> There is nothing magical about data centers making them safe while your local copy isn't. Is this a serious comment? My house is not certified as being compliant with any security standards. Here's the list that the 3rd party datacenter we use is certified as complaint with: https://aws.amazon.com/compliance/programs/ https://aws.amazon.com/compliance/programs/ The data centers we operate ourselves are audited against several of those standards too. I guess you're right that there's nothing magic about security controls, but it has nothing to do with trust. Sensitive data should generally never leave a secure facility, outside of particularly controlled circumstances.
- brmgb 6y ago
  Of course it's serious. You are entierly missing the point by quoting the compliance programs followed by AWS whose sole business is being a third party hoster. For most business, what you call sensitive data is customers and orders listing, payment history, inventory if you are dealing in physical goods and HR related files. These are not state secrets. Encryption and a modicum of physical security go a long way. I personally find the idea that you shouldn't store a local backup of this kind of data out of security concern entirely laughable. But that's me.
  - AmericanChopper 6y ago
    This is quite a significant revision to your previous statement that there’s nothing about a data center that makes it more secure than your house. This attitude that your data isn’t very important, so it’s fine to not be very concerned about it’s security, while not entirely uncommon, is something most organisations try to avoid when choosing vendors. It’s something consumers are generally unconcerned about, until a breach occurs, and The Intercept write an article about it. At which point I’m sure all the people ITT who are saying it’s fine to take your production database home would be piling on with how stupid the company was for doing ridiculous things like taking a copy of their production database home.