3 ms·

To be honest this is the more concerning thing in that quoted statement: > "Given the number of employees who have access to sensitive customer information" S

To be honest this is the more concerning thing in that quoted statement: > "Given the number of employees who have access to sensitive customer information" Surly they should have very very few employs that have access to that type of information?

eganist 4y ago
> Surly they should have very very few employs that have access to that type of information? It depends on the nature of the information. If we're talking anything that directly affects liquidity, I'd be surprised if that number was large. But if we're talking regulated or contractually protected consumer information (e.g PCI), that number's probably a bit bigger.
hourago 4y ago
You are completely right. Sensitive customer information should be only accessible as a per need basis. It's very bad practice, possibly illegal in many countries, to have free access to production customer data. It's also quite dangerous for a big company. Production databases should not be accessible by developers, logs should need enough to debug problems, and should be scrapped after some time. Metrics can be stored as long as needed, as should not contain personal data but just counters, averages, etc.
- SketchySeaBeast 4y ago
  A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.
tinco 4y ago
As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card. One kid definitely got fired for querying data on persons they weren't supposed to query for. With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.
kylecordes 4y ago
From a customers point of view, sensitive is a fairly broad term. Every customer service agent (of which they're hopefully quite a lot) has access to sensitive information.
kgermino 4y ago
Every tier 1 support rep needs to be able to pull up at least some of my account information. Sure IT and other internal teams shouldn't have direct access, but when your business is managing other people's accounts/money a lot of people will need to have access to customer data.
- UncleMeat 4y ago
  But you can still restrict that. Make it so every access must be tied to a specific open ticket. Don't just say "well, this person sometimes needs access to a specific customer's information so they can have permanent always-on access to all customer information."
  - verbify 4y ago
    That's a mitigation strategy but there are many open tickets at any one time. The employee can just go through open tickets and wreak havoc.
  - sebzim4500 4y ago
    How do you know it isn't? The only claim was that there are many employees with acess to 'sensitive customer information'. That would be the case even if the employees could only see customer information associated with tickets that they had been assigned.
- leokennis 4y ago
  I have a lot of access to very confidential customer information at my job. But based on passwords I need to request that require someone else to approve. Based on a ticket/incident/change number that actually needs to exist. The password rotates as soon as it expires. All password requests and usage are logged and audited. If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly.
  - hn_throwaway_99 4y ago
    > If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly. This doesn't make any sense to me, and is in fact exactly how it should work. So you're telling me that every time, say, a CS rep needs to access some sensitive customer information (which is almost every single call), you think they should need to go through some password approval process? Security procedures that are so cumbersome to getting work done get bypassed. The whole point of SSO systems is that you can immediately revoke access to any and all systems at once by just changing one setting.
patrec 4y ago
Not sure why you are being downvoted, I think in an industry that is rife with crime and theft of enormous sums you would indeed hope that some mature player like Coinbase restricts access to sensitive customer information to a really small part of their workforce. Having said that, we're still talking about hundreds of people being laid off, so even with excellent access controls this step might be prudent -- e.g. even customer support staff would have access to some stuff that would be useful for social engineering, at the very least.
zrail 4y ago
Unfortunately, least privilege access is not common practice in the industry yet. It's coming along, but it's a huge lift to get everything and everyone onboarded, especially if you have a bunch of legacy systems you need to retrofit. At companies where least privilege is a thing you can just revoke most of a person's permissions while leaving them access to, say, internal email and Slack. Without pervasive RBAC or ABAC that's basically impossible.
deleted 4y ago
[deleted]

eganist 4y ago

> Surly they should have very very few employs that have access to that type of information? It depends on the nature of the information. If we're talking anything that directly affects liquidity, I'd be surprised if that number was large. But if we're talking regulated or contractually protected consumer information (e.g PCI), that number's probably a bit bigger.

hourago 4y ago

You are completely right. Sensitive customer information should be only accessible as a per need basis. It's very bad practice, possibly illegal in many countries, to have free access to production customer data. It's also quite dangerous for a big company. Production databases should not be accessible by developers, logs should need enough to debug problems, and should be scrapped after some time. Metrics can be stored as long as needed, as should not contain personal data but just counters, averages, etc.

SketchySeaBeast 4y ago
A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.

tinco 4y ago

As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card. One kid definitely got fired for querying data on persons they weren't supposed to query for. With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.

kylecordes 4y ago

From a customers point of view, sensitive is a fairly broad term. Every customer service agent (of which they're hopefully quite a lot) has access to sensitive information.

kgermino 4y ago

Every tier 1 support rep needs to be able to pull up at least some of my account information. Sure IT and other internal teams shouldn't have direct access, but when your business is managing other people's accounts/money a lot of people will need to have access to customer data.

UncleMeat 4y ago
But you can still restrict that. Make it so every access must be tied to a specific open ticket. Don't just say "well, this person sometimes needs access to a specific customer's information so they can have permanent always-on access to all customer information."
- verbify 4y ago
  That's a mitigation strategy but there are many open tickets at any one time. The employee can just go through open tickets and wreak havoc.
- sebzim4500 4y ago
  How do you know it isn't? The only claim was that there are many employees with acess to 'sensitive customer information'. That would be the case even if the employees could only see customer information associated with tickets that they had been assigned.
leokennis 4y ago
I have a lot of access to very confidential customer information at my job. But based on passwords I need to request that require someone else to approve. Based on a ticket/incident/change number that actually needs to exist. The password rotates as soon as it expires. All password requests and usage are logged and audited. If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly.
- hn_throwaway_99 4y ago
  > If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly. This doesn't make any sense to me, and is in fact exactly how it should work. So you're telling me that every time, say, a CS rep needs to access some sensitive customer information (which is almost every single call), you think they should need to go through some password approval process? Security procedures that are so cumbersome to getting work done get bypassed. The whole point of SSO systems is that you can immediately revoke access to any and all systems at once by just changing one setting.

patrec 4y ago

Not sure why you are being downvoted, I think in an industry that is rife with crime and theft of enormous sums you would indeed hope that some mature player like Coinbase restricts access to sensitive customer information to a really small part of their workforce. Having said that, we're still talking about hundreds of people being laid off, so even with excellent access controls this step might be prudent -- e.g. even customer support staff would have access to some stuff that would be useful for social engineering, at the very least.

zrail 4y ago

Unfortunately, least privilege access is not common practice in the industry yet. It's coming along, but it's a huge lift to get everything and everyone onboarded, especially if you have a bunch of legacy systems you need to retrofit. At companies where least privilege is a thing you can just revoke most of a person's permissions while leaving them access to, say, internal email and Slack. Without pervasive RBAC or ABAC that's basically impossible.

deleted 4y ago

[deleted]