4 ms·
> And there was no way to find out who accessed what. This is not normal, it's a huge red flag One can argue that it shouldn't be normal, but I assure you that
by caeril 4y ago
> And there was no way to find out who accessed what. This is not normal, it's a huge red flag
One can argue that it shouldn't be normal, but I assure you that it is extremely normal in most companies. Shared root credentials, no audit logs, or audit logs that you have to grep on individual hosts - these are VERY VERY normal across business.
- MattPalmer1086 4y agoThey certainly exist, and I've worked at a few. They were all smaller organisations. I've seen medium sized companies wrestle with it a bit. No large organisation I've worked for had rampant prod access. Which I guess is why it surprises me that Twitter still operates like that.
- toomuchtodo 4y agoNormal is probably the wrong word. It’s expected for smaller or less resourced orgs to have immature security and data/access governance programs. But a public company such as Twitter (who has to adhere to Sarbanes Oxley and other regulatory frameworks that drive access control and RBAC)? Not so much.
- jagrsw 4y agoIt most likely shouldn't be normal in a company which is used for serious (as in, related to countries' relations or even wars in extreme cases) politics, no matter whether its founders wanted it or not. It wouldn't be probably an exaggeration to say that ability to post a tweet in someone's name, or ability to see private DMs can have financial effects (scams, frauds of big proportions), or in extreme, yet not unthinkable, circumstances lead to loss of health or life (war, terrorism).