So far, so good.
The issue was that the “sysadmins” knew almost nothing about how anything worked, so the procedure was that the devs would give them commands to type and they would just type them in to a terminal.
Of course, if anything went wrong, or was ambiguous, the dev would need to check on it, and would end up standing next to the “sysadmin”’s desk and just telling them which characters to type. I once had to explain what a pipe character was...
Anyway, the end result was that all of the devs had prod access, they just had a very slow interface to it.
They already have access to staging and preprod what they do is basically coming to me and saying 'it did run well on their macos machine'
There are outliers, some few good people and some random people having no idea what they are doing.
IMHO there should be random quiz/task/test each day you login. Something obvious but not trivial at the same time related with domain of the system. So you would get 24h access if you pass, get denied for 3 hours if fail. 3 questions in each session...
At least people might learn something out of requirement...
They also had a person who could see if the dev was stalking an ex-girlfriend or pilfering bank account info. Sounds perfect.
PHB: "They need access to all the systems."
Me: "Well, um, what if one of them got disgruntled and just tossed some malicious JS in one of your many, many front end servers? Given the procedures here, it would be unlikely anyone would stumble across it, but they'd get a good amount of hits before the browsers block the entire site and traffic precipitously drops."
PHB: "Nobody would ever actually do that. Besides: we have to give them access. (looks at me as if he's explaining something to a five year old) We're a devops shop..."
There are still vectors for bad actors of course, but the idea is to firewall those who write the code from those who run it.
It can be pretty hard if your organization was not organized with this in mind in the first place.
It devolves into a bunch of managers saying no ops person can have any write access to git at all and no dev person can have any read access to prod, let alone deploy code, thus throwing up a wall to have stuff thrown over.
Separation of duties is the worst, stupidest, clumsiest control ever but all the auditors and management types love it because it doesn't require them to think.
IT controls are far less used as the only control as the Phoenix Project alludes and yet the default state for any auditor is "it's all in Sox scope and everything is an IT control, lock it all down" and unless management has a clue and a care, they just do it.
In the process, they contort the CICD pipeline in horrible ways to say that yes, they have obtained the magical way of separation of duties.
I would be much more worried about security if the developers had access to the production environment than if they didn't.