3 ms·

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a scree

It's totally forbidden by PCI rules as well as common sense. Wayyyy back in 2002, I worked at a startup making a billing product. A customer asked for a screen to be able to see CC numbers for their own customers, and our response was a flat no. Any sensitive data was encrypted and sequestered, and security codes were absolutely not stored. In my current role at a startup, when a conflict between schedule/time or convenience conflicts with proper data security, I ask people to envision how our processes would look as a news headline or would fare in a legal discovery.

ngneer 3y ago
Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?
- fatnoah 3y ago
  > or is the main incentive to be able to tout compliance? At the time I joined, the existing goals were around compliance and checking boxes on security questionnaires, which is exactly the problem I'm trying to solve. Specifically, compliance was driven by the IT/Infra teams and mostly around access to access to cloud infra. That's obviously useless if a db server is locked down and change managed, but the software access the data isn't. So, the bulk of my efforts in this area have been around bridging the gap from checking boxes to actual compliance with various standards. Fortunately, we rely heavily on data, so it's not a hard sell to properly protect things. In general, people receive the questions well, as it makes the strong point that there's a big gap between checking a box that people in sales & marketing care about, vs. how any issues arising from not having "real" compliance would be catastrophic and business ending for a company of our size.
- neilv 3y ago
  > what is people's typical response and what is the dynamic? Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems. One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol. When I started to tell the director to whom I reported, I felt an initial "oh no..." mixed with skepticism, from hints in their voice. So I explained, and answered their questions. Then they seemed to switch from dread, to solving it. Instead of quietly taking the client's money, they halted integration, and put together a presentation for the customer, telling them how part of their security had a grave problem. (Possibly awkward, because it might've been a team internal to the customer who had made such a mistake on something so sensitive.) I'd say that the dynamic in that case was what you'd like to imagine from engineers who'd risen in influence: acknowledging the problem, understanding and doing the right thing, when it had to be done, even when they wish it didn't.
  - neilv 3y ago
    I've also seen other dynamics, in which pointing out what should be showstopper problems didn't go as well. I assume that the most common in business as a whole is a variation on: someone doesn't want to hear about it, because (put broadly) acknowledging it would conflict with business goals or their individual goals. Example conflicts: don't get a sale, slip the schedule, fail to meet some individual OKR/KPI, or expose an earlier mistake of the individual. Also, the dynamic doesn't have to come down to conflicts between plausibly rational motivations (for business or self). Egos and irrational cognition are also parts of our collective human situation, and an individual's particular traits (or a personal challenge they're going through) can sometimes lead to that taking over decisions. It happens, and we should try to realize when that's the cause (rather than just an attempt at cover for some rational motive they don't want to state), so that we can try to get to rational decision-making. A different thing, or a complication: There are also be dynamics in which an 'ambitious' person in an org, not naturally involved in the situation, uses the situation to grandstand or hit a rival. And obviously this can affect the dynamics for people who are involved (e.g., person A would normally do the aligned thing for the company, but it's more complicated now that B will twist that to gun for their job). Fortunately, I don't immediately recall seeing an egregious example first-hand, but have heard of it.
Sohcahtoa82 3y ago
> A customer asked for a screen to be able to see CC numbers for their own customers I'd be curious what reason they had.
- bee_rider 3y ago
  In 2002? Probably something now-crazy like “how else will I process returns?” It is not directly related, but as a hopefully funny semi-related anecdote, the federal government stopped states from putting social security numbers on drivers licenses in 2004. Renewals frequency depends on the state, but it is typically in the 4-8 year range, so plausibly until 2012 people were going around showing their SSN to anybody that needed to see ID. I specifically remember this caused stressful situations as a teenager working retail, people justifiably didn’t want to show an ID when doing returns because it had their SSN. A credit card number is hardly anything comparably! This all seems absurd nowadays, but the past is not really that long ago.
  - wombatpm 3y ago
    At one time it was routine to have your SSN and Drivers License # printed on your checks. And in 1988 my student ID number as university was my SSN.
    - bee_rider 3y ago
      But 1988 is officially The Past, ask any millennial, my self image can’t deal with the fact that our anecdotes objectively belong side-by-side.
      - pavel_lishin 3y ago
        At the risk of instantly drying into dust by suggesting that 2002 is also The Past, but my SSN was also my student ID then.
        QuercusMax 3y ago

ngneer 3y ago

Out of curiosity, and without naming names, what is people's typical response and what is the dynamic? Data security is hardly ever convenient, and most often vies for resources with other features or quality improvements, especially in a startup seeking to make its fortune. Can people even imagine breach ramifications without having been previously burnt, or is the main incentive to be able to tout compliance?

fatnoah 3y ago
> or is the main incentive to be able to tout compliance? At the time I joined, the existing goals were around compliance and checking boxes on security questionnaires, which is exactly the problem I'm trying to solve. Specifically, compliance was driven by the IT/Infra teams and mostly around access to access to cloud infra. That's obviously useless if a db server is locked down and change managed, but the software access the data isn't. So, the bulk of my efforts in this area have been around bridging the gap from checking boxes to actual compliance with various standards. Fortunately, we rely heavily on data, so it's not a hard sell to properly protect things. In general, people receive the questions well, as it makes the strong point that there's a big gap between checking a box that people in sales & marketing care about, vs. how any issues arising from not having "real" compliance would be catastrophic and business ending for a company of our size.
neilv 3y ago
> what is people's typical response and what is the dynamic? Not the OP. One place, a few times when I was doing an integration with a large company, I discovered a grave security flaw in the customer's systems. One time, had I done the integration despite the flaw, it would've required me to knowingly code some obviously 100% wrong use of cryptographic protocol. When I started to tell the director to whom I reported, I felt an initial "oh no..." mixed with skepticism, from hints in their voice. So I explained, and answered their questions. Then they seemed to switch from dread, to solving it. Instead of quietly taking the client's money, they halted integration, and put together a presentation for the customer, telling them how part of their security had a grave problem. (Possibly awkward, because it might've been a team internal to the customer who had made such a mistake on something so sensitive.) I'd say that the dynamic in that case was what you'd like to imagine from engineers who'd risen in influence: acknowledging the problem, understanding and doing the right thing, when it had to be done, even when they wish it didn't.
- neilv 3y ago
  I've also seen other dynamics, in which pointing out what should be showstopper problems didn't go as well. I assume that the most common in business as a whole is a variation on: someone doesn't want to hear about it, because (put broadly) acknowledging it would conflict with business goals or their individual goals. Example conflicts: don't get a sale, slip the schedule, fail to meet some individual OKR/KPI, or expose an earlier mistake of the individual. Also, the dynamic doesn't have to come down to conflicts between plausibly rational motivations (for business or self). Egos and irrational cognition are also parts of our collective human situation, and an individual's particular traits (or a personal challenge they're going through) can sometimes lead to that taking over decisions. It happens, and we should try to realize when that's the cause (rather than just an attempt at cover for some rational motive they don't want to state), so that we can try to get to rational decision-making. A different thing, or a complication: There are also be dynamics in which an 'ambitious' person in an org, not naturally involved in the situation, uses the situation to grandstand or hit a rival. And obviously this can affect the dynamics for people who are involved (e.g., person A would normally do the aligned thing for the company, but it's more complicated now that B will twist that to gun for their job). Fortunately, I don't immediately recall seeing an egregious example first-hand, but have heard of it.

Sohcahtoa82 3y ago

> A customer asked for a screen to be able to see CC numbers for their own customers I'd be curious what reason they had.

bee_rider 3y ago
In 2002? Probably something now-crazy like “how else will I process returns?” It is not directly related, but as a hopefully funny semi-related anecdote, the federal government stopped states from putting social security numbers on drivers licenses in 2004. Renewals frequency depends on the state, but it is typically in the 4-8 year range, so plausibly until 2012 people were going around showing their SSN to anybody that needed to see ID. I specifically remember this caused stressful situations as a teenager working retail, people justifiably didn’t want to show an ID when doing returns because it had their SSN. A credit card number is hardly anything comparably! This all seems absurd nowadays, but the past is not really that long ago.
- wombatpm 3y ago
  At one time it was routine to have your SSN and Drivers License # printed on your checks. And in 1988 my student ID number as university was my SSN.
  - bee_rider 3y ago
    But 1988 is officially The Past, ask any millennial, my self image can’t deal with the fact that our anecdotes objectively belong side-by-side.
    - pavel_lishin 3y ago
      At the risk of instantly drying into dust by suggesting that 2002 is also The Past, but my SSN was also my student ID then.
      - QuercusMax 3y ago