4 ms·
Exactly. Employee A adds a feature and adds security policies X and Y to prevent abuse. Employee B adds another feature and disables policy X because it conflic
by hathawsh 3y ago
Exactly. Employee A adds a feature and adds security policies X and Y to prevent abuse. Employee B adds another feature and disables policy X because it conflicts with the new feature and policy Y is still in place. Employee C adds some functionality that conflicts with policy Y, but reasons that's OK because a comment says the feature is protected by both the X and Y policies. So policy Y gets disabled too.
You can see why everyone would then start pointing fingers at each other. Hopefully, regular reviews and careful analysis prevent this kind of situation.
- thephyber 3y agoThe combinatorics works against “regular reviews and careful analysis”. The more the network grows, the more time+resources each review will take, but must be done at a regular interval, squeezing out other priorities. The best solution to keeping the combinatorics down is to have someone with authority who is happy to say “no” when a proposed new service doesn’t closely align with the org’s key goals.
- Eisenstein 3y ago> Hopefully, regular reviews and careful analysis prevent this kind of situation. Without incentives it will just keep happening. We need to: 1. Incentivize emphasis on security by penalizing data breeches in a non-trivial way 2. Make orgs much more careful about the data they collect by mandating penalties which scale exponentially with the potential harm of the data which was released -- up to and including existential destruction