6 ms·

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you ge

• encoderer 4y ago
  Yes and it’s a good thing that most industries do not carry this governance burden.
  • mschuster91 4y ago
    If more industries did carry this governance burden, we'd see a lot less cases of companies getting hacked left and right. For way too many companies, "IT" is just another cost center that doesn't bring in any profits and so is barely kept at life support levels. And when something inevitably happens, it's rarely the C-level that gets to go to the unemployment office, it's more one poor soul who has complained for years that he needs more staff and budget to at least get the most egregious bullshit fixed.
    • phpisthebest 4y ago
      I doubt that, many of the companies that have been hacked were governed by these regulations, and they spent money governing to the regulations not governing to security which is not the same thing If I was burdened by regulation and red tape I can assure you my org would be less secure not more so
    • seti0Cha 4y ago
      Hah, I might have agreed before I worked on a credit card processing system. There were plenty of rules alright, but it's possible to abide by all the rules without actually making a secure system. Some of the rules made it harder to create a secure system because they did not reflect the state of the art, or they made adding additional security too burdensome to implement. In the end, you can't force competence through rules.
      • closewith 4y ago
        > In the end, you can't force competence through rules. I mean, we have in all other forms of engineering. Why is software different?
        • bigbillheck 4y ago
          Sounds like a pretty good argument for 'software engineering is not engineering'.
          • closewith 4y ago
            I think we can all (mostly?) agree that most of what's called software engineering doesn't live up to the standards (including responsibilities of the developers/engineers) of the other formalised engineering disciplines.
        • seti0Cha 4y ago
          The software world evolves much faster than any of the engineering disciplines and has fewer physical constraints. The requirements for software are rarely fully specified when construction starts. Software is faster to build, deploy and fix so getting it right the first time is not as important. The environment in which it is deployed changes rapidly and in entirely unexpected ways, which is not the case for things built by engineers. There are plenty of differences. In practice, software is more like a craft than an engineering discipline.
          • closewith 4y ago
            > The software world evolves much faster than any of the engineering disciplines and has fewer physical constraints. The requirements for software are rarely fully specified when construction starts. Software is faster to build, deploy and fix so getting it right the first time is not as important. The environment in which it is deployed changes rapidly and in entirely unexpected ways, which is not the case for things built by engineers. These are all artefacts of software development as we practice it, rather than truisms. > In practice, software is more like a craft than an engineering discipline. Maybe we should reserve the term software engineering for the applications of software development where rigour is involved?
  • kixiQu 4y ago
    They do have a burden. Following the law is table stakes. Now, are the laws relevant to a business the same across industries and around the globe? No. Does enforcement have its shit together equally everywhere? Obviously not. But making every team in a company classify the XYZ their component stores is absolutely doable and frankly an easy lift when the alternative is not doing business that involves XYZ.
  • PuppyTailWags 4y ago
    I think specifically any industry working in personal data collection of minors should absolutely have this governance burden. If Meta knows enough about their users to know Instagram is giving teenage girls mental illnesses, Meta engineers should absolutely be hoisted out of their beds if they don't have precise, well-defined, secure data stores.
    • conductr 4y ago
      The problem with your example is the engineers have built exactly what the company wanted. Perhaps the mental illness was an unintended side effect (perhaps known). But either way a decision was made that they want X and so the engineers built X. What you're talking about is banning X, which is something a bit difference than a governance burden/compliance issue as those can generally be followed to a specification and directly measured for deficiency (eg. how to handle HIPAA data, how long to store records, etc.) If the issue is about teenagers being too immature for the product X, then typically we ban it or age restrict it using legislation (eg tobacco, alcohol, porn, etc) I think we as a society need to figure out where social media fits in and how we want to contain it and it's still early days for that. As much as I like the idea of an age restriction, I look around the world and see 6 month olds playing with iPads, 6 year olds on tiktok, etc. as the more 'average' way to parent and wonder if I'm in the minority. My kid is 4 and has never touched a device as entertainment, we taught him how to eat out at restaurants/be in public instead of pacifying him. But that seems like an old fashioned parenting method. Ok, he's technically used it briefly as a viewfinder for the camera and to facetime his grandparents
      • TomSwirly 4y ago
        > it's still early days for that. We've had social networks for twenty five years.
• nicolas_t 4y ago
  Counterpoint, in my career, I've seen a lot of Security Audits that seem on paper to be very thorough and detailed but when you dig deeper, you can see that it only touched the surface and the auditor missed a lot of things.
  • delusional 4y ago
    I have in fact only seen these kinds.
    • vidanay 4y ago
      Same with certifications. (e.g. ISO 900x certification - you can still build a shit product, but it will be a very well documented shit product.)
  • tremon 4y ago
    I'd guess there's a difference between an external audit performed for regulatory of financial reasons, and an audit by the internal legal team because of a pending legal case or regulatory scrutiny.
    • bravetraveler 4y ago
      There's a very wide gap in what needs to be covered as a result of this consideration! Disaster recovery/business continuity? Absolutely, you need it documented so that someone 'off the street' could be helpful. Implementing yet another service gateway? Probably going to take a lot of conversations with people familiar with the streets involved. Auditors won't care until it's realized. They'll want things like interconnection diagrams -- painting a picture so they can follow your adherence. We have very high compliance requirements where I work -- about half of my time is spent on it. They're less worried about how the bread is made, more that you can keep making bread the way you say you do.
  • kixiQu 4y ago
    I mean, sure, security is complicated, lots of judgment calls, but within this mindset, if a team/org/company said "we have no idea where we're using log4j" it was then their job to have someone working around the clock until they figured that out and fixed it. Figuring out how to meet new requirements that weren't around when systems were begun is, IMO, fully just part of the job. For FB engineers to be throwing up their hands in front of a legal system like oh nooooo how could we possibly track things seems like a stalling technique and makes all of tech look bad.
• ACow_Adonis 4y ago
  Counterpoint: the conclusions of legal, compliance and security rest upon social fictions and power structures, but fundamentally at a certain scale, all things act like the original commenter said. In my experience with the above, people get paged until a "socially plausible fiction or resolution" can be created. There's several versions of these, one of which is to engage in enough rituals and processes so that we all pretend the task has been completed and the requisite outputs and points of reference exist. An archaeologist knows they don't and they can't and that we lay on bedrocks of speculation, history, ignorance and myth, but we don't have to worry too much about the fiction we create because we also know that disproving such mechanically is also extremely impossible/unlikely. And we have a host of other social functions to get out of the cases where it could, such as: - throwing people under the bus/human sacrifice/ finger pointing - contrition - plausible deniabilty - continued non-compliance and non-enforcement - bribery - bullshit jobs
• marcosdumay 4y ago
  > if a single reference doesn't exist for something that is necessary for compliance, people get paged until it does. And you will trust the reference like if it perfectly describes the reality. Because, really, there is no other way to deal with it. You can test a thing or two and improve it, but you can't test for the absence of necessary information. The Facebook situation is inexcusable. But no company has perfect knowledge about this either ("perfect" here carrying a lot of weight).
• vineyardmike 4y ago
  I’ve also worked for big tech companies. On one of my teams, all those docs are written by college hires as a “learning opportunity” and they’re surface level only. Outside of medical or financial systems, I’m guessing most of those docs aren’t worth their weight in bytes. Here is one conversation I’ve heard: “We stream our logs [full of PII] to a central repo. Do we need to include that in our docs?” “No. It’s just logging. It’s a standardized tool we use. It’s probably assumed. Just include the database and known clients.”.