5 ms·

Once upon a time, I worked for a shop that did auto insurance. This involves handling a lot of fairly sensitive data about people and datasets about a lot of pe

by Kalium 4y ago

Once upon a time, I worked for a shop that did auto insurance. This involves handling a lot of fairly sensitive data about people and datasets about a lot of people, for reasons that boil down to it being incredibly useful data for actuarial purposes. Bossware, or working machine monitoring software, endpoint monitoring, or whatever turned out to be a key part of making it possible for our data scientists to function. At all. It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed. Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks. "But wait!" you protest, "Can't the business work just as well without that sensitive information?". That's a good question! The short answer is no. No, it cannot, and unfortunately there's a great deal of actuarial history behind this. "But wait!" cry you, "Could you have not simply trusted them?". That's also an excellent question! To which the uncomfortable response runs roughly: how comfortable do you feel with "we trust them" as the primary security controls when some company has your data? Especially when that trust means you might not even know about a breach? How do you think a regulator concerned with privacy would look at "we trust them" as a security and privacy approach? Unfortunately, I think some forms of bossware serve a purpose. Sometimes it's one of the few options available that enables trust beyond the directly interpersonal.

detaro 4y ago
I think there is certainly a place for audit trails etc, but it again comes back to how that data is used. An access log is an access log, but it's a difference if you analyze it to find people looking at data they have no reason to look at, or if you analyze it to track who spends how long on their toilet break. And a lot of what's offered by current "bossware" clearly falls in the latter category.
- Kalium 4y ago
  I agree. My goal here is to set out that there are important uses for monitoring. Uses important enough that it would be irresponsible to discard the notion entirely.
bart_spoon 4y ago
> Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks. Provision some isolated machines with access to production data, and let the data scientists login remotely. You'll be able to tell who is accessing the data and when, and won't need to install invasive bossware on their systems. It's a fairly straightforward solution. It's one thing to control access to sensitive data. Its another to use that to justify monitoring employees all day, even when they aren't accessing sensitive data.
- Kalium 4y ago
  Now you need to convince them to use this system. You also need to convince them to not use this system, where they're injecting arbitrary code into the sandbox remote machine, to download the data to their local machines where they can work in the way they understand and are comfortable with. Inevitably some person will react badly to the perceived lack of trust or object to what they see as making their job more difficult for no reason. There are a lot of options for monitoring for that kind of thing. You monitor the remote machine, you monitor the network traffic between it and their local terminal... and the most valuable will be monitoring their local machine to associate with the rest of the access and usage information. Among other things, you need to be able to distinguish between someone using the data scientist's credentials and the data scientist using their own credentials. Your idea is a wonderful approach! It improves security, privacy, traceability, and auditability. It may not be the same as removing the need for endpoint monitoring, unfortunately.
  - asdff 4y ago
    You can never perfect endpoint monitoring. At the very least, the engineer could see data, go to the bathroom, and write down what they saw on a scrap of paper. As long as eyeballs see data this is possible no mater what software you install on device, or even if you have an armed guard sitting in the office right behind the engineer.
wazanator 4y ago
Yeah, do people really want no supervision on employees handling their PII or other sensitive info? I think I would be upset if I found out my info was not even being attempted to be protected while in an employees possession.
biotinker 4y ago
I worked as a bioinformatician at a medical device company. We did genetic testing on cancer patients, and had huge amounts of private, personal information on the patients we were testing, because it was necessary to provide the correct clinical determination. We also didn't have bossware. There were access controls on the data itself, audit trails on who accessed the data, but no software running locally on my personal dev machine looking at what I did at any particular moment. HIPAA governs the storage, transport, and use of that health information, and we all knew we were criminally liable if the information got out. Bossware in a HIPAA environment (or other environment where not having leaks in important) can be more of a liability than a boon, because it becomes yet another vector for attack or data leakage. You are in effect sharing all data a machine can access, with the maker of the bossware. Something with the teeth of HIPAA but for other pieces of personal information could go a long way. It's amazing how differently executives behave when the consequences of data leaks change from "customers could be unhappy if they found out" to "I could personally go to prison".
Buttons840 4y ago
> It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed. Meanwhile this data is getting leaked every other week by other companies. Didn't Equifax leak pretty much all sensitive information for the entire nation. What happened there? I haven't formed a constructive thought out of all this yet, I'm just frustrated that we'll get surveillance software to allegedly protect data that's already been leaked by a hundred other companies. Often this will be like the "think of the children" argument. Of course we should be concerned about security and make efforts to protect data, but many times the same people who push surveillance software in the name of security will later turn a blind eye to other security practices or concerns that might be an inconvenience to them. Their concern for security will extend only as far as it gives them power.
- Kalium 4y ago
  It's very often different companies and different systems. It's rarely the companies with mature and well-implemented security, privacy, and governance systems that do Equifax-style data spills. To draw an imperfect comparison - improving the efficiency of electric car motors does little for those driving dino-juice-mobiles. That we as a society have the tools and ability to do better does not mean that every person and organization adopted them immediately and perfectly.
tomrod 4y ago
> anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks. Joint distributions and generating functions trained against the production data to generate synthetic data, generally.

by Kalium 4y ago

detaro 4y ago

I think there is certainly a place for audit trails etc, but it again comes back to how that data is used. An access log is an access log, but it's a difference if you analyze it to find people looking at data they have no reason to look at, or if you analyze it to track who spends how long on their toilet break. And a lot of what's offered by current "bossware" clearly falls in the latter category.

Kalium 4y ago
I agree. My goal here is to set out that there are important uses for monitoring. Uses important enough that it would be irresponsible to discard the notion entirely.

bart_spoon 4y ago

> Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks. Provision some isolated machines with access to production data, and let the data scientists login remotely. You'll be able to tell who is accessing the data and when, and won't need to install invasive bossware on their systems. It's a fairly straightforward solution. It's one thing to control access to sensitive data. Its another to use that to justify monitoring employees all day, even when they aren't accessing sensitive data.

Kalium 4y ago
Now you need to convince them to use this system. You also need to convince them to not use this system, where they're injecting arbitrary code into the sandbox remote machine, to download the data to their local machines where they can work in the way they understand and are comfortable with. Inevitably some person will react badly to the perceived lack of trust or object to what they see as making their job more difficult for no reason. There are a lot of options for monitoring for that kind of thing. You monitor the remote machine, you monitor the network traffic between it and their local terminal... and the most valuable will be monitoring their local machine to associate with the rest of the access and usage information. Among other things, you need to be able to distinguish between someone using the data scientist's credentials and the data scientist using their own credentials. Your idea is a wonderful approach! It improves security, privacy, traceability, and auditability. It may not be the same as removing the need for endpoint monitoring, unfortunately.
- asdff 4y ago
  You can never perfect endpoint monitoring. At the very least, the engineer could see data, go to the bathroom, and write down what they saw on a scrap of paper. As long as eyeballs see data this is possible no mater what software you install on device, or even if you have an armed guard sitting in the office right behind the engineer.

wazanator 4y ago

Yeah, do people really want no supervision on employees handling their PII or other sensitive info? I think I would be upset if I found out my info was not even being attempted to be protected while in an employees possession.

biotinker 4y ago

I worked as a bioinformatician at a medical device company. We did genetic testing on cancer patients, and had huge amounts of private, personal information on the patients we were testing, because it was necessary to provide the correct clinical determination. We also didn't have bossware. There were access controls on the data itself, audit trails on who accessed the data, but no software running locally on my personal dev machine looking at what I did at any particular moment. HIPAA governs the storage, transport, and use of that health information, and we all knew we were criminally liable if the information got out. Bossware in a HIPAA environment (or other environment where not having leaks in important) can be more of a liability than a boon, because it becomes yet another vector for attack or data leakage. You are in effect sharing all data a machine can access, with the maker of the bossware. Something with the teeth of HIPAA but for other pieces of personal information could go a long way. It's amazing how differently executives behave when the consequences of data leaks change from "customers could be unhappy if they found out" to "I could personally go to prison".

Buttons840 4y ago

> It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed. Meanwhile this data is getting leaked every other week by other companies. Didn't Equifax leak pretty much all sensitive information for the entire nation. What happened there? I haven't formed a constructive thought out of all this yet, I'm just frustrated that we'll get surveillance software to allegedly protect data that's already been leaked by a hundred other companies. Often this will be like the "think of the children" argument. Of course we should be concerned about security and make efforts to protect data, but many times the same people who push surveillance software in the name of security will later turn a blind eye to other security practices or concerns that might be an inconvenience to them. Their concern for security will extend only as far as it gives them power.

Kalium 4y ago
It's very often different companies and different systems. It's rarely the companies with mature and well-implemented security, privacy, and governance systems that do Equifax-style data spills. To draw an imperfect comparison - improving the efficiency of electric car motors does little for those driving dino-juice-mobiles. That we as a society have the tools and ability to do better does not mean that every person and organization adopted them immediately and perfectly.

tomrod 4y ago

> anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks. Joint distributions and generating functions trained against the production data to generate synthetic data, generally.