4 ms·

I do not understand this part: we (banking software) have trivial rules that completely stop this: I would hope bigger organizations have this too. But simply;

I do not understand this part: we (banking software) have trivial rules that completely stop this: I would hope bigger organizations have this too. But simply; support roles (all roles are limited: millions cannot happen; you need a big bug for that) cannot view over 100 customers a day: if they hit that 100 2 days in a row, their account is blocked and their manager (also access to 100 a day but can unblock support employees) has to check the reason and unblock. How does a support account actually give you access to all customer data? What is the point of that?

willcipriano 5y ago
That feature is in the backlog, we are working on the confetti that rains down in the app if the stock price goes up this sprint.
spicybright 5y ago
You don't even need a technical solution to at least catch the easy exploits I think. Get one smart dude to call in pretending to be a customer to "pen test". Do that once a month, would take maybe an hour or two of the dude's time.