My side is that I worked for a bank on the brokerage side for ten years in different positions. What always struck me was that my access was very carefully controlled, I was a background checked employee and had to meet with compliance once a year, etc etc.

However when a law firm asked for anything or consultants said they needed more data they just sent massive data dumps to the network admin guy, no questions further asked. At least not at my pay grade.

As I've consulted I ask for only what I need to keep my own risk down but it is always a surprise to my clients I don't want PII I don't need and only the data that my model will help enhance.

Some of our customers did have pretty strong proesses in some places... but then zero when a process changes or something like that.

Lots of: "Oh no we can't do that because <security>".

Ok makes sense. It's a hassle but it is a good policy.

"But you can..."

All sense out the window, everything is undone.

Though many instances of weak links in process due to human nature that get overlooked and only come to light once there is an incident.

Which is the crux, incidents cause things to change, yet if you see that potential flaw the gravatas you have in flagging that issues is often dismissed because it hasn't happened. That is sadly often a pattern we see play out time and time again in many forms.

We had been told to expect some visitors from that office, but I was almost hoping he was not legit, since most of us at my location still do not have a company ID, so I couldn't really say if his was real or not.

We were told it was ok and all the paperwork had been done (we had a somewhat legitimate need), but if that's the case the standards are far too loose and there are far too many copies of patient data around.

It was great for development though.

Oh gosh yes. I couldn't have done the project without it, to be honest, not in the time frames needed. Still makes me a little queasy though, although I was the only person given access to said data sets and met with executives from said companies prior to, so I suppose it's not quite as crazy as I made it sound...

That doesn't protect you from accessing and leaking data.

Senior managers don't need to control the servants' access because they won't take your job, they're lesser beings in the caste system. The control is there for those who might take your job or customers because they are caste equivalents.

At no stage are customers' concerns so much as considered. Control is not of the data, it's the vital control of peers and rivals. If you're not a rival, who cares?

Data security is a myth.

The knowledge level on those staff's is often near 0, they operate with wonky budgets (here is a gazillion dollars for ipads... no money to maintain them or the rest fo the systems), and are just making do the best they can.

The IT staff at one complained to me the librarian at one elementary school kept changing things on them. In reality she had a clue and they couldn't even operate rudimentary role based access type system to stop her.

Living inside the beast for my entire career - We have just enough funding to keep the doors open, and remain staffed at a minimal level. Additional funding, above what we can raise through local taxes, ALWAYS comes with an asterisk.

So we can get access to $50,000 supplemental funding this year, awesome. But we have to buy I-pads. Nevermind that literally every other piece of technology in the building is windows based. Oh, and we cannot spend that on infrastructure upgrades to the wi-fi system to support the extra capacity. And it has to be spent in six months or you lose it.

It's the way we're funded in the US. It isn't necessarily a function of the schools or the staff therein. Those people are generally trying to do their best.

It's the shit system and it needs to be burnt to the ground.

Not just schools. A lot of government-related sectors.

Transit is a big one. Back when I used to follow this sort fo thing, I would see a lot of municipalities turning down federal grants because the money could only be spent on buses, trains, an related infrastructure; and the towns and cities didn't have the money to pay for the people involved.

Maybe when self-driving vehicles become common, this won't be so much of a problem anymore.

Several years ago, one of our competitors implemented a public-facing web-based form for a local ISD. When the form loaded, the user was prompted with two pieces of info: a student's last 4 digits of SSN and their birthdate. The form then performed an AJAX request to the server, which did a DB lookup and pulled in ALL the transcript data of the matching student record to send back to the front-end.

Said competitor then presented this "solution" at a vendor conference and bragged about how amazing and easy to use it was and how the parents loved it because they no longer had to call the school to request transcripts yadda yadda. When casually asked about security/privacy concerns, their engineer basically said "well, how likely is it that an unauthorized party will know both a student's birthdate and the last 4 digits of SSN? Probably not very."

...yeah.

Nevada, for example, is funded by sales taxes, ad valorem property taxes ("property" as in things, not houses and land), gambling taxes, federal money, estate taxes, and mining taxes.

http://ftp.ccsd.net/directory/budget-finance/pdf/Funding_K-1...

I expect FAANGS to do the same.

My other comment was sent to oblivion because it is politically incorrect, but the reality is that a lot students have loyalties to the old country. Also when you add the family back there and corruption being a normal way of getting things done, these things are bound to happen. I don't suggest to freeze them out, just don't be surprised.

Note that there are many different types of background checks, varying from things like "working with children" checks, to financial status checks, to security checks of different kinds.

You are correct - it's very hard for a foreign person to pass some types of these. In some cases that means it's very difficult for them to get one of these jobs.

A lot of things are broken in USA but it's light years away in that department compared to a lot of countries.

Let’s say an IC designer offshores some work, that company has other clients as well and the off shore company has access to a lot of the R&D of the client company. Lots of things can happen in that situation and does happen.

Another branch where you might expect security awareness is anti virus companies. I'm a pentester and in smallish companies everyone knows everyone, but nobody knows me, yet most days I can tailgate into the office without question. This morning a lady asked suspiciously "are you looking for someone?" and I just replied that I know where to go, thanks. I walked on and she didn't pursue. Free rein.

I don't have to mention any specific company, this happens everywhere. Helpful, trusting that everything will be alright, clicking links... Vulnerabilities help but they are optional.

I wish I could tell people that having that much access raises legal issues for me.

It's not enough to have them sign a contract limiting liability because as a business they have far more lawyers than I do.

When I work on a contract I want to be able to say in court that I couldn't possibly be in any way related to the event of a bug, security breach or data loss because I simply do not have access.

It is genuinely worrying on my part to carry around credentials with that much data. What if my laptop is hacked or stolen? I do not want to be sued (again it doesn't matter if they have a valid case or not, I don't want to deal with legal fees or anything.)

This is what I wish.

Obviously things are far from that.

BMO and another org in 2018. BMO's security was atrocious, for a while they had you use your 4-digit pin to log into online banking. One of the reasons I ended up switching to Tangerine...