Re:Elon Musk emails employees about 'extensive and damaging ...
by _Codemonkeyism on Tuesday June 19, 2018 @05:42AM
(#17345072)
Not only banks, every company listed in the US. It was the same where I've worked, and it wasn't a bank (Enron was no bank either).
Re:Elon Musk emails employees about 'extensive and damaging ...
by alanfranzoni on Tuesday June 19, 2018 @05:51AM
(#17345121)
> As a developer
What if the employee were a sysadmin-level person that sidestepped the normal process?
Re:Elon Musk emails employees about 'extensive and damaging ...
by falsedan on Tuesday June 19, 2018 @06:10AM
(#17345222)
The you say in your compliance policy that you run regular audits for these kinds of actions and remediate them on a case-by-case basis.
E.g. run quarterly reports for changes to prod that didn't go through the regular release pipeline and note down which P0 they corresponded to.
As a developer I'm not allowed to have write access to any production system, except in an emergency via a break-glass mechanism, which is audited to the hilt and back.
It also means we're not allowed to deploy software to production systems. This has to happen via a specific chain development > regression / user acceptance testing > production.
All those environments need to be physically seperated with very specific access requirements.
The deployment process needed to be signed off by outr auditors.
I can't speak for other banks, but they probably need to implement the same -, or a similar system.
Neither can I speak for SOX requirements regarding software fo car manufacturing.