3 ms·

Requirement to log doesn't mean the record has to be in online storage though. It could easily get rotated into cold storage every month with only a unique offl

Requirement to log doesn't mean the record has to be in online storage though. It could easily get rotated into cold storage every month with only a unique offline password granting you access.

JumpCrisscross 2y ago
> Requirement to log doesn't mean the record has to be in online Banks are (or were) required, in America, to use write-once offline media for records [1]. [1] https://en.m.wikipedia.org/wiki/Write_once_read_many https://en.m.wikipedia.org/wiki/Write_once_read_many
idrios 2y ago
I think the word "easily" is carrying a lot weight here -- for a company the size of Disney, keeping all internal communication records in secure offline storage sounds pretty hard from both a technical and operational standpoint. Certainly doable, but I doubt it'd ever happen unless it were required by law
- SilasX 2y ago
  I guarantee you that large-cap, highly scrutinized public companies comply with much harder regulations and internal controls than this.
- viraptor 2y ago
  There are various levels of offline. For example you can have an S3 bucket with write-only access. No, it's not perfectly offline. But it's isolated from both vulnerabilities and from hacked employees, which covers most common types of breaches. You can solve 99% of the offline storage features without having an actual physical location with tapes.
  - compootr 2y ago
    what about hacked employees' aws accounts?
    - mlyle 2y ago
      Unless they're highly privileged enough to turn on read access to the bucket, you're fine. Thus, you can contain most breaches of credentials.
    - viraptor 2y ago
      Employees shouldn't have default access to those credentials. This applies to audit/backup/account management/billing privileges. You can have very dedicated roles with lots of restrictions for those specific things.
    - atkailash 2y ago
      [dead]
    - inkyoto 2y ago
      If the organisation doesn't use SSO coupled with MFA and the enforcement of the least amount of privileges principle on a cloud platform, then they have no right to complain about security breaches.
prng2021 2y ago
Have you ever worked for a company larger than a 3 person startup? When you work at a company with hundreds of thousands of people, how can you “easily” move data into cold storage without destroying employee productivity? Don’t be hand wavy. Be specific about your solution. Do you move all old files, emails, internal knowledge articles, code repos, chat messages, etc etc to cold storage? You can’t search for anything you’re looking for in OneDrive, Outlook or Slack if the data is in cold storage so are you going to develop custom applications to support the same search filters as each original source application, but which searches your cold storage? Once a user finds something in cold storage, you have to load it back into the SaaS app to display it. Why? A variation of the following applies to all enterprise data: A Slack message has tons of important metadata tied to it besides the text content. For example Slack user Id of the message sender, channel ID it was in, file ids of any file attachments in the message, and so on. How do you load that back into Slack from your cold storage? You can put any data in cold storage. In the real world, that often makes the data almost useless for employees.

Requirement to log doesn't mean the record has to be in online storage though. It could easily get rotated into cold storage every month with only a unique offline password granting you access.

JumpCrisscross 2y ago

> Requirement to log doesn't mean the record has to be in online Banks are (or were) required, in America, to use write-once offline media for records [1]. [1] https://en.m.wikipedia.org/wiki/Write_once_read_many https://en.m.wikipedia.org/wiki/Write_once_read_many

idrios 2y ago

I think the word "easily" is carrying a lot weight here -- for a company the size of Disney, keeping all internal communication records in secure offline storage sounds pretty hard from both a technical and operational standpoint. Certainly doable, but I doubt it'd ever happen unless it were required by law

SilasX 2y ago
I guarantee you that large-cap, highly scrutinized public companies comply with much harder regulations and internal controls than this.
viraptor 2y ago
There are various levels of offline. For example you can have an S3 bucket with write-only access. No, it's not perfectly offline. But it's isolated from both vulnerabilities and from hacked employees, which covers most common types of breaches. You can solve 99% of the offline storage features without having an actual physical location with tapes.
- compootr 2y ago
  what about hacked employees' aws accounts?
  - mlyle 2y ago
    Unless they're highly privileged enough to turn on read access to the bucket, you're fine. Thus, you can contain most breaches of credentials.
  - viraptor 2y ago
    Employees shouldn't have default access to those credentials. This applies to audit/backup/account management/billing privileges. You can have very dedicated roles with lots of restrictions for those specific things.
  - atkailash 2y ago
    [dead]
  - inkyoto 2y ago
    If the organisation doesn't use SSO coupled with MFA and the enforcement of the least amount of privileges principle on a cloud platform, then they have no right to complain about security breaches.

prng2021 2y ago

Have you ever worked for a company larger than a 3 person startup? When you work at a company with hundreds of thousands of people, how can you “easily” move data into cold storage without destroying employee productivity? Don’t be hand wavy. Be specific about your solution. Do you move all old files, emails, internal knowledge articles, code repos, chat messages, etc etc to cold storage? You can’t search for anything you’re looking for in OneDrive, Outlook or Slack if the data is in cold storage so are you going to develop custom applications to support the same search filters as each original source application, but which searches your cold storage? Once a user finds something in cold storage, you have to load it back into the SaaS app to display it. Why? A variation of the following applies to all enterprise data: A Slack message has tons of important metadata tied to it besides the text content. For example Slack user Id of the message sender, channel ID it was in, file ids of any file attachments in the message, and so on. How do you load that back into Slack from your cold storage? You can put any data in cold storage. In the real world, that often makes the data almost useless for employees.