0

So I am developing an employee management application on behalf of a company and am concerned about the extent of rights and capabilities that are to be bestowed upon registered administrator accounts.

Here's the question under a philosophical light: "What is to be done when the one with power is corrupt?"

Here's the question under a more practical example: "What is to be done when the one in charge of a bank is corrupt?"

Now I'm not even suggesting that the company is corrupt, but I am wondering if there are some, perhaps light-hearted, measures that can be put in place to avoid the potential of fraud that may be accessible to those with administrator powers.

It's not easy to find any information online in regards to this. How do people deal with this concerning issue? Surely it isn't to simply be dismissed; banks have authorities and standards they must adhere to, but what arbiter of justice resides in the land of software?

  • Do I just trust the company that their appointed Administrators who deal with HR and registration of employees are reliable?
  • Do I include analytical components that act as a light but unnoticeable deterrence e.g. if an administrator downloads a passport at a certain time, should this be backlogged in a database? If so, what should be done with it and who is it accessible by?
1

Do I just trust the company that their appointed Administrators who deal with HR and registration of employees are reliable?

Is deciding who should be an administrator part of your job responsibility? Because if it isn't, then you'd be crossing a line by mixing yourself in that discussion.

This is the more abstract variation on asking where you should control people's access to your company's building. If you're not hired for that purpose, it's not your place to do so, especially not without being prompted to do so by your employer.

You mean well, but you are making calls that (presumably) aren't yours to make.

Anecdotally, I've actually suffered at the hand of a company that relied on this behavior from their employees. Every new hire would always be introduced to every employee of the company (> 50 people). But as a consultant, I wasn't ginven this introductory tour.
For months, people tried to block me from using the parking lot (they clamped my wheel), taking the elevator (refusing to let me on), asking a question (refusing to talk to me), or even just getting a cup of coffee (one guy even took the cup from my hands) because "they didn't know me and they know everyone who works for the company".

If you see misbehavior, you're allowed to report it. If you see a weakness in the system, you are morrally expected to point it out.
But if all you're doing is questioning the company's ability to assess its employees without any concrete evidence of bad assessments, then you're only going to end up worse for wear when you pipe up.


Do I include analytical components that act as a light but unnoticeable deterrence e.g. if an administrator downloads a passport at a certain time, should this be backlogged in a database? If so, what should be done with it and who is it accessible by?

You can definitely point out the ability to log it, and the security benefit of doing so. But if the company (or your team lead) says no, then the answer is no. Unless they are breaking any law, you have no responsibility to whistleblow or override your superiors.

0

Companies have to abide by the law of the land just like anyone else. And depending on how big they are and what field they are in, will be audited by various other companies or government organisations.

Also, they run the risk of being sued and then having to disclose their bad behaviour to a court after the fact. Or more likely, find they are unable to prove they followed best practices in protecting whatever rights the person suing them has.

A basic example would be not storing passwords in plain text. Say my facebook account is hacked and I sue facebook. During the court battle, I, (Representing myself), demand that facebook present to the court a list of everyone who has access to see my password.

If they can't show this list, then I turn to the judge (with a solemn face) and rest my case, facebook obviously have not been taking security seriously if they dont even know who can access my data!

If they show the list and its very small, I then turn to the judge and (with a wry face and sarcastically raised eyebrow) (with the latest newspaper open on my desk https://www.wired.com/story/facebook-passwords-plaintext-change-yours/) ask that facebook be found in contempt of court! As their list is obviously wrong!

If they show the list and its very big, I then turn to the judge (with an outraged and unbelieving face!) and demand the (law)book be (ironically) thrown in facebook's face! as various privacy legislation requires that they take care of my data, which means not letting more people than necessary see it.

So, when facebook get new bits of software written for them, they will have a whole bunch of requirements around 'compliance' so that if I ever sue them they can produce a whole load of audit reports and documents proving that they have been very careful with my data.

If you have not received any requirements from your customer, it might be a good idea to raise this with them. Ask if they have any requirements around security and GDPR compliance etc. You will have to be careful as they may assume that you will be doing 'all those things' as standard.

0
  1. The way you formulated your question indicates that there are no business requirements for audit.
  2. Hiring company explicitly trusts hired person. Trust level increases after trial period.
  3. Trust relationship is formulated in employee's contract. Ex. "... shall not disclose to any third party the business of the Client, details regarding the Software, including, without limitation any information regarding the Software’s code...".
  4. Maybe if you don't trust employee then you should monitor them in one place like their computer and not spread auditing features to every system they might use.
  5. You aren't gonna need it
0

As a professional, you have ethical obligations to the stakeholders of your system (see examples such as the ACM Code of Ethics and Professional Conduct or the IEEE Computer Society/ACM Software Engineering Code of Ethics and Professional Practice). It seems like you are on the right track early, trying to identify ways where people could be harmed by improper use of your software and evaluating the impact of the system that you are creating (or the system that you are supporting).

Since you've identified some risks, such as authorized users who may act maliciously or want to commit fraud. Minimally, you should be raising these risks to the appropriate people who are supporting the product or project - there may be missing requirements around this. Perhaps the stakeholders haven't thought of this. Maybe their current system doesn't make certain operations possible or may already have certain controls in place so they didn't think to specify them. Or maybe they just never thought of these risks. Regardless, everyone involved should be observant around risks to health and safety, security, and privacy. If raising these concerns up to the proper people doesn't get you anything, then it's up to you to make the decision - do you want to continue working on a project if you have concerns about the impact of what you are making to various stakeholders?

In some of the specific examples that you cite, you can go even further, the notion of requirement patterns (see also the book - Software Requirement Patterns by Stephen Withall). There are common patterns that have been observed when talking about authentication, authorization, auditing, and reporting. These types of concerns, at a functional level, aren't often unique to a particular system and there are requirement patterns, industry good practices, or even regulatory requirements that can support the elicitation, development, and implementation of requirements. These requirement patterns can serve as a basis for a further discussion with the stakeholders on what the system should do or what capabilities it should provide, while mitigating some of the risks that you've identified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.