Every tier 1 support rep needs to be able to pull up at least some of my account information. Sure IT and other internal teams shouldn't have direct access, but when your business is managing other people's accounts/money a lot of people will need to have access to customer data.

But you can still restrict that. Make it so every access must be tied to a specific open ticket. Don't just say "well, this person sometimes needs access to a specific customer's information so they can have permanent always-on access to all customer information."

How do you know it isn't? The only claim was that there are many employees with acess to 'sensitive customer information'. That would be the case even if the employees could only see customer information associated with tickets that they had been assigned.

That's a mitigation strategy but there are many open tickets at any one time. The employee can just go through open tickets and wreak havoc.

I have a lot of access to very confidential customer information at my job. But based on passwords I need to request that require someone else to approve. Based on a ticket/incident/change number that actually needs to exist. The password rotates as soon as it expires. All password requests and usage are logged and audited.

If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly.

> If you need to completely revoke someone's account overnight to prevent adverse impact, you designed your "access matrix" incorrectly.

This doesn't make any sense to me, and is in fact exactly how it should work.

So you're telling me that every time, say, a CS rep needs to access some sensitive customer information (which is almost every single call), you think they should need to go through some password approval process? Security procedures that are so cumbersome to getting work done get bypassed.

The whole point of SSO systems is that you can immediately revoke access to any and all systems at once by just changing one setting.

Of course it will depend on exactly how sensitive etc. the information is and there are always grey areas.

But indeed, permanent access to sensitive info without ever needing approval from a second person (beyond being hired and gaining the access) seems like a bad idea.

As a teenager I worked an evening job at one of the largest banks in the world, processing mail-in credit card orders. I would sit at a computer, run an app that could query any bank account number, and I'd get their current balance (along with all other personal info). It was part of a series of checks I had to do to make sure they qualified for the credit card.

One kid definitely got fired for querying data on persons they weren't supposed to query for.

With work-from-home, I can imagine there's employees with all sorts of access. And with them being a startup, who knows how much controls they've got in place yet.

Not sure why you are being downvoted, I think in an industry that is rife with crime and theft of enormous sums you would indeed hope that some mature player like Coinbase restricts access to sensitive customer information to a really small part of their workforce.

Having said that, we're still talking about hundreds of people being laid off, so even with excellent access controls this step might be prudent -- e.g. even customer support staff would have access to some stuff that would be useful for social engineering, at the very least.

Unfortunately, least privilege access is not common practice in the industry yet. It's coming along, but it's a huge lift to get everything and everyone onboarded, especially if you have a bunch of legacy systems you need to retrofit. At companies where least privilege is a thing you can just revoke most of a person's permissions while leaving them access to, say, internal email and Slack. Without pervasive RBAC or ABAC that's basically impossible.

> Surly they should have very very few employs that have access to that type of information?

It depends on the nature of the information. If we're talking anything that directly affects liquidity, I'd be surprised if that number was large. But if we're talking regulated or contractually protected consumer information (e.g PCI), that number's probably a bit bigger.

From a customers point of view, sensitive is a fairly broad term. Every customer service agent (of which they're hopefully quite a lot) has access to sensitive information.

You are completely right. Sensitive customer information should be only accessible as a per need basis. It's very bad practice, possibly illegal in many countries, to have free access to production customer data. It's also quite dangerous for a big company. Production databases should not be accessible by developers, logs should need enough to debug problems, and should be scrapped after some time. Metrics can be stored as long as needed, as should not contain personal data but just counters, averages, etc.

A responsible company would consider "sensitive customer information" to be pretty much every bit of customer information - names, addresses, phone numbers, bank accounts. Maybe low-level developers won't have access to that but every member of the infrastructure and customer facing teams will in some fashion because it's 100% part of their job and odds are good that's the majority of the people in the company.