3 ms·
I can't judge if their employees need that much access to production. However, if they need this, you need a detection mechanism. It doesn't have to be advance
by oxfordmale 4y ago
I can't judge if their employees need that much access to production.
However, if they need this, you need a detection mechanism. It doesn't have to be advanced; a threshold on the number of production keys accessed per day is sufficient. It should raise the alarm to the manager in question, who can then confirm if this is expected behaviour given the tasks assigned to the employee in question.
- maccard 4y agoAgain I'm not saying circle CI didn't mess up, but that's orthogonal to whether or not someone has access to customer data.
- oxfordmale 4y agoNot necessarily. AWS engineers cannot access your encryption keys unless you give them explicit permissions. They even offer Nitro enclaves where AWS Engineers can never access your keys. Giving access to customer data to your staff by default is a design decision and can be avoided. However, in the end, it is a cost-benefit analysis where you have to decide how much you care about your customer's security. I have worked for enough start-ups/growth companies to know the value put on customers' security is sometimes shockingly low.