3 ms·

> Employees can easily access the user's data and impersonate any account At every decent sized company I've worked for, topics like production data privileges

> Employees can easily access the user's data and impersonate any account At every decent sized company I've worked for, topics like production data privileges, data classification (public, sensitive, confidential, etc.), data masking, and data anonymization for testing have been top priorities. And these policies are sometimes a true pain in the ass for developers, but they exist for a good reason. I guess you shouldn't miss the timing to go from "move fast and break things" to "ok we're now a serious business".

xmprt 3y ago
And the secret they don't tell you is that at least some employees still need to have that access even at the largest companies. People working on the storage team probably can access the data whenever they like (although it's against company policies) and while there are probably access logs to ensure trace who accessed what, the employees still have and need the access to perform their job duties.
- hubraumhugo 3y ago
  Absolutely, humans are still the weakest link
jstummbillig 3y ago
Being a "serious business" is very, very hard, because the world is hellbent to assign blame. Even most big business are not serious businesses in this sense (look at the cases that, to this day, are being brought to and won against big tech). In most cases, the outfall is relatively manageable. If you are less lucky, it won't be. Having run a couple of businesses and feeling the pain I still don't see how to better the situation. It's good that businesses are put under pressure, because if they are not, bad actors would run wild. It is bad that running any business, at least to me, feels like navigating a minefield, and good actors are negatively impacted by that disproportionally. Personally, I have come to accept that, no matter how hard you can reasonably try, with any business and at any given moment, there is a number of things that if somebody looked very closely, that would probably raise some red flags, because the cost of safeguarding against all of them is infinite.

xmprt 3y ago

And the secret they don't tell you is that at least some employees still need to have that access even at the largest companies. People working on the storage team probably can access the data whenever they like (although it's against company policies) and while there are probably access logs to ensure trace who accessed what, the employees still have and need the access to perform their job duties.

hubraumhugo 3y ago
Absolutely, humans are still the weakest link

jstummbillig 3y ago

Being a "serious business" is very, very hard, because the world is hellbent to assign blame. Even most big business are not serious businesses in this sense (look at the cases that, to this day, are being brought to and won against big tech). In most cases, the outfall is relatively manageable. If you are less lucky, it won't be. Having run a couple of businesses and feeling the pain I still don't see how to better the situation. It's good that businesses are put under pressure, because if they are not, bad actors would run wild. It is bad that running any business, at least to me, feels like navigating a minefield, and good actors are negatively impacted by that disproportionally. Personally, I have come to accept that, no matter how hard you can reasonably try, with any business and at any given moment, there is a number of things that if somebody looked very closely, that would probably raise some red flags, because the cost of safeguarding against all of them is infinite.