<story><title>Hacker Bribed &apos;Roblox&apos; Insider to Access User Data</title><url>https://www.vice.com/en_us/article/qj4ddw/hacker-bribed-roblox-insider-accessed-user-data-reset-passwords</url></story><parent_chain><item><author>UI_at_80x24</author><text>The real takeaway from this:&lt;p&gt;Do your threat models include your staff?
    Of course, nobody has admin access.&lt;p&gt;Do your threat models include your staff accessing restricted information that they need to access?
    How do you stop somebody from doing their job?&lt;p&gt;IME this is a great interview question to ask potential employers.  The rabbit hole that you are required to go down will open eyes.&lt;p&gt;The answer is: you can&amp;#x27;t.
But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.</text></item></parent_chain><comment><author>kbenson</author><text>&amp;gt; IME this is a great interview question to ask potential employers.&lt;p&gt;That also sounds like an easy way to immediately exclude yourself and cut the interview short.  It&amp;#x27;s sort of like interviewing someone for a security position, and them asking &amp;quot;by the way, what brand of locks and safes do you use, and what&amp;#x27;s your alarm company and specs?&amp;quot;  It&amp;#x27;s not hard to see how it could be taken the wrong way, and giving information about internal security procedures (even generalities) to someone not contractually obligated to the company in some way doesn&amp;#x27;t seem a good idea to me.</text></comment>
<story><title>Hacker Bribed &apos;Roblox&apos; Insider to Access User Data</title><url>https://www.vice.com/en_us/article/qj4ddw/hacker-bribed-roblox-insider-accessed-user-data-reset-passwords</url></story><parent_chain><item><author>UI_at_80x24</author><text>The real takeaway from this:&lt;p&gt;Do your threat models include your staff?
    Of course, nobody has admin access.&lt;p&gt;Do your threat models include your staff accessing restricted information that they need to access?
    How do you stop somebody from doing their job?&lt;p&gt;IME this is a great interview question to ask potential employers.  The rabbit hole that you are required to go down will open eyes.&lt;p&gt;The answer is: you can&amp;#x27;t.
But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.</text></item></parent_chain><comment><author>munchbunny</author><text>&lt;i&gt;Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job?&lt;/i&gt;&lt;p&gt;That&amp;#x27;s precisely the hard question, but I think you can reframe that question: &amp;quot;How can you tell when somebody is accessing data that isn&amp;#x27;t necessary to do their job, in a given specific case?&amp;quot;&lt;p&gt;For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they&amp;#x27;re all situational possibilities.)&lt;p&gt;I don&amp;#x27;t think there are any easy answers, but I do think there&amp;#x27;s some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.</text></comment>