If one of our programmers went rogue, we would have an even bigger problem on our hands. They could clone all of our source code, copy tons of the secure information off the database, and sell it to whoever they pleased. I don't believe that anyone I work with would commit such a heinous crime, but there are thousands of other companies who have the same amount of information we have. Those companies have hundreds of programmers with access to information that could be mine! Odds are that some programmer out there, with access to my information, is not a law-abiding citizen. We need to worry as much about that programmer as we worry about security holes in our software systems.
My company makes us sign a few papers saying we wont steal information when we are first hired and that's about the end of it. That means similar companies probably have the same procedure. This small amount of attention is nothing compared to the millions spent on finding security holes. Companies with secure data should put just as much attention to reviewing and testing employees as they do into finding security holes. Only then would our information be truly safe.
While you're right that some programmer or system admin with a hankering for extra cash could cause lots of issues there are checks in place to deal with that. Some databases record date/time and user info for when people access it. A programmer copying the entire database would be a major red flag...
ReplyDeleteWhat if it is the database administrator him/herself! Haha, you get the point. I was definitely erring on the dramatic side.
ReplyDeleteWhat if it is the database administrator him/herself! Haha, you get the point. I was definitely erring on the dramatic side.
ReplyDeleteYes, but how? In business most security is contractually obligated. For example, Nintendo requires that you store their debug hardware in a locked office. But there is no federal regulation of protection of users' personal information.
ReplyDelete