August 1, 2010 at 9:41 pm
I don't think you can avoid it - there will always be people who need access to sensitive data and it simply comes down to people having a strong-enough moral backbone to avoid the temptation.
Several years ago, when I was working on healthcare systems in Australia, there were reports of hospital staff releasing information on celebrities. Those involved had a legitimate reason for having access to that information, but misused their position.
At the end of the day, if people need access to sensitive data, they must be made aware that misuse will result in them losing their job - personally, I think that goes without saying but, unfortunately, some people do need to be told.
Chris
August 2, 2010 at 4:24 am
Having not worked with encrypted data/databases I would have thought that payroll or even personal information systems should have encrytped data and aren't viewable by anyone but in senior management.
But I guess it's human nature: where there's a will, there's always a way... 😛
qh
August 2, 2010 at 5:53 am
Good editorial Steve!
I agree in principle. But I have yet to see a way to implement this using SQL Server. I don't think SQL Server is the issue, I think it's simply this: In any system, you must trust someone. For me this was driven home implementing SOx compliance at a couple companies...
Auditor: "Can DBAs change data in Production?"
Me: "Not only can they change data in Production, we pay them to do it."
Auditor: Scribbles furiously...
Exposure to this data is going to happen. I don't know how to not-read words and numbers I see. If I see them, I read them. What I do with that knowledge is a different matter. Most DBAs I know are the type of people that can be trusted with knowledge of salaries - that's part of the job in my opinion. Trustworthiness is definitely near the top of my list when I interview candidates for data professional positions.
Working one of my few stints as a DBA, I was shocked that data of this nature was floating around the enterprise so freely. I found live HR data (salaries+) in Development and Test environments and proceeded to obfuscate it. I'm not saying this justifies anyone taking a peek, but companies need to do a better job keeping honest people honest.
:{> Andy
Andy Leonard, Chief Data Engineer, Enterprise Data & Analytics
August 2, 2010 at 6:04 am
HR / Payroll information is separate and highly secured. However, everything eventually comes to our production environment. With the right access and knowing the correct cost center and GL account, the information is there. Payroll information is not broken out by employee, but rather by department.
A co-worker (DBA) knows I am currently up for a raise due to drastic changes in my responsibilites. He told me that he knows how much our GL account increased when a certain developer came on board. I am certain he will be watching over the next few months to see if there are changes in our cost center again. Of course - all SQL people are geniuses, so it won't be hard for him to calculate MY new salary.
August 2, 2010 at 6:43 am
While I understand the need for privacy, I also do some snooping just to understand the characteristics of the data within the database. All the planning in the world cannot predict what the consumer will actually enter into fields. Take for example addresses. You can have fields for street number, street direction, street name, and street type, but there is almost no way to force a user to properly enter the data as designed. I've found frequently that the entire street address is normally "forced" into the street name field. Also, just understanding the paremterics of the data, the percentage of nulls, etc. is necessary sometime for determining the selectivity of indexes. What you may define snooping as looking at specific values within the data, I use the term more for determining the characterization of the data. In my case snooping is good :-).
Mike Byrd
August 2, 2010 at 7:24 am
When starting at a new job, I was appalled to find that the vendor (large, name you'd recognize) of a key software package dealing with HIPAA data provided a 'masking' script and encouraged loading our production database backup into a development database and running the script. Yeah, on the surface it sounded good until I looked at the data afterward. Not only did the script run for 26 hours (at the time, our database was about a third of what it is now) but it didn't come close to masking all the data.
As a result, I actually dug into the database and wrote my own masking utility (currently runs in 1 hour) and completely masks [all] patient data.
I'm curious if a company got 'dinged' for unmasked data could turn it back on the vendor for supplying an inadequate method of masking and presenting it to their clients under the pretense it was HIPAA compliant...
Ken
DBA: Jack of all trades, master of a dozen or so
August 2, 2010 at 7:26 am
Sorry - the point of my post is that the developers should see the structure of the database and 'placeholder' data but there's no reason they should see live data. Typically the security on a development or test database is a fifty-cent cab ride from nonexistent.
August 2, 2010 at 7:49 am
Excellent Editorial Steve! Two thumbs up!
I was surprised the by the reference to 74% of IT professionals... I was also disappointed by it.
I agree. All IT professionals should ignore the temptation of data snooping and practice self-control of their actions.
The only possible exception to this may by for someone working in data security, even then, the company payroll data would be off limits unless they were auditing security controls or access to the data.
August 2, 2010 at 8:21 am
Perhaps what we need, for those who administer data systems is more integrity. I'm shocked at the number of IT specialists who you claim "admit to data snooping" - I certainly am not aware that the number would be so high. I have worked with some very sensitive data over my career and at least almost all of the other experienced DBA's I've worked with have been intelligent enough to know there are some lines not to be crossed. - I have worked with data that required me to sign agreements prohibiting that kind of activity under penalty of what I would consider significant jail time. Trusting someone with your sensitive data is the equivalent of trusting people with your money and your livelihood. If you even halfway suspect that someone is snooping, you need to make some changes. I dont know where you have taken your sample from, but that is scary and perhaps I need to do my own polling where I'm working now. We are all aware of the importance of maintaining a strong sense of our clients information - at the risk of losing a client - or all of them. You simply cannot run a business if people are looking where they should not. We audit access to sensitive information. Its a part of what we do. I have worked in perhaps a dozen places in my career and to my recollection that seems to always be the case. Is it simply that we have too many amateurs doing the work of professionals?
Ultimately if the quality of your people isnt high enough, you should probably do a little housecleaning and perhaps that attitude wouldnt be so prevalent.
Sorry for my passion, but it takes a certain type of trustworthy individual to put into a position where they have access to sensitive data. Allowing people with no integrity access to your data, because they claim to know how to patch a system is in my mind, unthinkable. Isnt that why we do background checks? - Or are we not doing those anymore?
There is a principle that the safest gate is the one that is guarded, not by a lock, but by a living, breathing guard with integrity, who knows and follows the rules. Thats the people who are trusted at our highest levels of security, not simply a child with a knack for hacking into a computer system, who has been snooping all their life. You might as well be hiring your people from a teenage chat room if that is who you are giving access to your sensitive data. Integrity is a life skill, the lack of which should be taken seriously, Perhaps you shouldnt even be in buisiness if it isnt. I have left companies where it was clear that wasnt a priority. Suprise, suprise that most of them have folded. The company I work for now is committed to protecting its clients information. Very significant assets are exausted on assuring that no one is out there browsing through data looking for something that suits their own personal interests.
That number, 74% is really shameful. I would think it should be more like 10% and dropping rapidly. Are there companies that simply dont want to bear the expense of setting expectations, and getting rid of those who will not comply with reasonable rules?
August 2, 2010 at 8:32 am
I suppose it depends how snooping is used. If snooping is used to expose positions that are grossly overpaid, then its a good thing. (From time to time, I see government employees who show up in the news for being overpaid) Or if snooping is used to expose how little or unfairly an employee, perhaps a developer, is getting paid(while working overtime for free) vs how much commission a sales person is getting(again the developer working over time for free due to promises made by sales people), then I have a hard time saying snooping is bad if one party is being taken advantage of over what are shady business practices. 🙂
Or you might just overhear the salesman say "the margin is great" while they are on their way to golf and you will be skipping dinner in a few hours. 🙂
August 2, 2010 at 8:37 am
The above post, I believe points out the obvious that not everyone should have access to sensitive data. If they were applying at my company, they wouldnt get a second interview.
Was this some kind of joke in response to my post?:w00t:
August 2, 2010 at 8:46 am
No, not a joke, in fact I think we were writing at the same time. I was just wondering on how some positions or group of people do end up getting exposed when they think no one is watching them. Does a person have a moral obligation to look into things on their own if they suspect something is up? Or do they rely on other people who should be watching out for the company or government, when in fact the other people are also part of the problem. Lots of people in this world who bend the rules for their own needs, while most of us just want something fair.(see banking industry 2003-2007)
Perhaps my examples are on the extreme side I would agree, but probably not all that much.
August 2, 2010 at 8:49 am
Dimbulbz (8/2/2010)
... I don't know where you have taken your sample from, but that is scary and perhaps I need to do my own polling where I'm working now.
It's from a survey done of IT Professionals. I have to admit I was shocked as well.
August 2, 2010 at 9:20 am
Correct me if I'm wrong, but this survey was done by a company whose reason for existing is basically preventing people seeing stuff they shouldn't--so I have to wonder exactly how impartial the results are! How did they define "snooping" in the survey question, for example? There are always ways to word these things to massage the results in the direction you want...
Viewing 15 posts - 1 through 15 (of 31 total)
You must be logged in to reply to this topic. Login to reply