Industry


Ads by TechWords

See your link here


Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Sharky's picture
Sharky

Shark Tank

You can trust us, we're from IT

This pilot fish is meeting with the local sheriff, discussing IT security and personnel records. 

"The sheriff presented his new program to streamline the application process in becoming a deputy, and its integration with the National Crime Information Center and FBI databases for background checking," says fish. "Very important and very sensitive information."

How is the information secured? fish asks sheriff.

"It's on the F: drive," sheriff says. "The F: drive has all the super-secure information -- gangs, undercover operations, etc."

Who has access to the F: drive? asks fish.

"Only the gang operatives, undercover ops, background investigation detectives and I have access to that sensitive data."

How about the IT staff?

"Yes, of course."

Are the IT staff sworn officers, and were they background checked?

Reports fish, "The sheriff went bright red. 'No' was the whimpered response."

Send Sharky your true tale of IT life at sharky@computerworld.com and I won't tell -- but I'll send you a stylish Shark shirt if I use it. Add your comments below, and read some great old tales in the Sharkives.

Now you can post your own stories of IT ridiculousness at Shark Bait. Join today and vent your IT frustrations to people who've been there, done that.

What People Are Saying

Another side of that coin

For years the other DBAs and I struggled with the HR manager responsible for security on their SAP systems. She had no trust whatsoever of IT people, although, of course, HR people had free access to all the ultra-sensitive information. It was easier for her, in her ignorance, to keep us out of transactions we needed in order to manage those systems effectively than to figure out what she was doing. So, we were constantly explaining the access we needed for specific tasks, she would give it to us for the few minutes necessary, then she would revoke it. All in the interest of protecting the data. The funny part was that we had free access to the data at the Oracle level. No, I'm not saying we (ab)used that access, only that we had it. And there was nothing she could do about it. Sometimes ignorance is a good thing.

blog dynamics

"jim, wer r u?"

it used to be fun
but now is none.

is fluffy the new face of evil?

JIM had nothing for this

JIM had nothing for this one.

Security

After being in IT for more years than most people alive, my agency several years ago contracted with Sheriff's office to maintain their IT dept. This was after a incident where it was discovered that the previous sheriff had hired a Russian civilion to program and maintain their network.
Myself and my staff had to go through extensive background checks and take poligraphs.
We passed but found it difficult finding new hires to pass the tests for new positions.
IT controls all access to servers, files etc. Also needs to know enough about NCIC FCIC regulations to solve problems

Why do they need access.

Why does the IT staff need access to the 'F' drive ? You give access as needed. I hope they can do their job without access to everything.

Why do they need access

I work for the local sheriff as a civilian IT person. You don't need to be a sworn officer to have access to the data. I am certified by the state to access this information.

Access is mandatory; sorry.

IT has to be able to access it. Based on the type of data noted you must have a data recovery scheme with some type of backup. Therefore at least one IT account must have the ability to see the data and structure to back it up. Any IT person involved in the backup then has access.

Also in the real world police come and go on a regular basis in these assignments. Someone with the appropriate skill has to add the new people on the detail to the drive security.

In a police agency the demand is for access setups NOW; so only a person with dedicated knowledge can setup and troubleshoot problems on demand. That is rarely a sworn officer; usually the technical civilian.

You can still insist on proper clearance

Agree, but there is nothing to stop the department from requiring a background check (i.e. clearance) for ALL personnel who access that data including IT folks as well as police officers, clerks, etc.

Encryption?

There could certainly be encryption or other secure/authorized data access methods to a DB that do not require actual ability to view data while still being able to perform backups, etc.

Yes, at some point, someone in IT may need to view the data to do some sort of troubleshooting. However, this could be limited to a single person during the specified period only to perform the required activity. In addition, this activity could be done in the presence of an actual deputy...

Required Access

Someone has to administer the system.

Remember ...

Root == GOD so use your powers sparingly.