Rogue Colleagues The economy might be good or bad for you right now. Some of that depends on where you live, what your employment situation is like, what your habits dictate about how you live life, and more. No matter what your situation, likely there are people around you that complain about the world and others who think things are fine. There are likely more of the former than the latter, but that's because humans tend to complain out loud more than they praise. When people think there is an economic downtown for themselves, they may be more likely to engage in malicious activities. While I don't think most data professionals will start to hack other systems, or even their own employer's systems, there is evidence to support the idea that some might be susceptible to recruitment by bad actors. This piece references some research and warns security groups to be wary. There is no shortage of books, or television and movie scripts that might show creative ways to access information, but how can you tell if a colleague makes a simple mistake or they are a bad actor? Clicking on a phishing email could be either one. Not removing anonymous access to an S3 bucket could be either. Losing their credentials through social engineering is something that happens every day. Who's to say that this happened purposefully? I don't want to second guess the people I work with making mistakes, but I also think these possibilities are why we want to use our computer systems with strong auditing and multiple groups reviewing logs. We might not necessarily stop all activity, but we can often detect it quickly and mitigate the issues. It's also why DevOps and automated deployments with logging are a good idea. They can limit the problems from both accidents and malicious actors. My employer has started to do more education around security and how individuals can avoid accidentally causing issues. We use a lot of automation, and more all the time, that ensures once we know how we ought to patch and update systems, we can do it regularly and confidently. Repeatable, reliable deployments of changes are what we aim for. We know they'll be some mistakes, but we also know that we can quickly identify issues (MTTD) and fix them (MTTR). Even if we get a bad patch from a vendor, we can quickly deploy a "fix" if we get one, or even reinstall and re-patch to lower levels, if needed. DevOps, GitOps, and other xxOps aren't just about getting new features out quickly. They also include the ability to fix problems when the need arises. They don't prevent rogue actors from causing issues, but they should help you detect and recover quicker than you might expect. Steve Jones - SSC Editor Join the debate, and respond to today's editorial on the forums | 
