you know. I’ve worked at large corporations that were required to be HIPAA and PCI compliant. the big database with millions of records of sensitive information was limited access. who had access to it?
the application
the DBAs who managed it
me, who managed the application and was backup for the DBAs
not even the execs had access to it.
my point is, it sounds like they aren’t following compliance requirements and should probably face a class action suit at the least.
Yeah i write financial software now and we’re PCI compliant. Devs can’t access prod or its very limited and read only with no access to encryption keys. Those who do have prod access, don’t have write access to the code. No one has both.
All software installs on any company device are reported to ops.
I’m not saying this couldn’t happen but i think it would be way more difficult. Also, we’re a company of 15 people.
you know. I’ve worked at large corporations that were required to be HIPAA and PCI compliant. the big database with millions of records of sensitive information was limited access. who had access to it?
not even the execs had access to it.
my point is, it sounds like they aren’t following compliance requirements and should probably face a class action suit at the least.
Yeah i write financial software now and we’re PCI compliant. Devs can’t access prod or its very limited and read only with no access to encryption keys. Those who do have prod access, don’t have write access to the code. No one has both.
All software installs on any company device are reported to ops.
I’m not saying this couldn’t happen but i think it would be way more difficult. Also, we’re a company of 15 people.