Saturday, October 19, 2013

Rogue Nerd

In 1990, some German hackers were put on trial for stealing US government information and selling it to the Russian KGB.  This, and countless other hacking fiascos, proved that computers are vulnerable to data thieves.  I know how careful we software engineers must be from personal experience.  I write software that touches MILLIONS of American's personal information.  If I code up one security hole, it's not only my rear-end on the line, but a fat lawsuit agains my company.  To make sure there our no holes, the executives put millions of dollars into security reviews and testing.

If one of our programmers went rogue, we would have an even bigger problem on our hands.  They could clone all of our source code, copy tons of the secure information off the database, and sell it to whoever they pleased.  I don't believe that anyone I work with would commit such a heinous crime, but there are thousands of other companies who have the same amount of information we have.  Those companies have hundreds of programmers with access to information that could be mine!  Odds are that some programmer out there, with access to my information, is not a law-abiding citizen.  We need to worry as much about that programmer as we worry about security holes in our software systems.

My company makes us sign a few papers saying we wont steal information when we are first hired and that's about the end of it.  That means similar companies probably have the same procedure.  This small amount of attention is nothing compared to the millions spent on finding security holes.  Companies with secure data should put just as much attention to reviewing and testing employees as they do into finding security holes.  Only then would our information be truly safe.

4 comments:

  1. While you're right that some programmer or system admin with a hankering for extra cash could cause lots of issues there are checks in place to deal with that. Some databases record date/time and user info for when people access it. A programmer copying the entire database would be a major red flag...

    ReplyDelete
  2. What if it is the database administrator him/herself! Haha, you get the point. I was definitely erring on the dramatic side.

    ReplyDelete
  3. What if it is the database administrator him/herself! Haha, you get the point. I was definitely erring on the dramatic side.

    ReplyDelete
  4. Yes, but how? In business most security is contractually obligated. For example, Nintendo requires that you store their debug hardware in a locked office. But there is no federal regulation of protection of users' personal information.

    ReplyDelete