What would happen if the director suddenly gets sick or decide not to come to work anymore? A lot of people assume that humans are reliable, they are not.
Exactly: limiting access is fine, lack of contingencies is not.
Some systems and services still only allow for one owner though (I'm not going to name names), which can be a big problem when MFA is mandated. From what the poster I responded to said, I'd be very surprised if that were the case for them though - just slightly daft policy.
One of my first boss called it the bus factor, not sure where the term comes from. What's the minimum number that need to get hit by a bus before it's impossible to keep things running. He used to say "you always have some bus factor, but it should never be one unless you're alone, otherwise you deserve whatever crap is going to rain on you someday".
I've found that to be incredibly true in my career.
My team rotates 1 sacrificial member every week to be on call with prod k8s access. It limits who can just push things to prod at any given time while making sure everyone on the team has experience. If someone is out sick or on vacation we do time trading, it works out for everyone.
With AI agents, I've been using sites/services that are bot friendly and don't require MFA.
Not everything needs hyper security. Heck, I've given AI access to spend money on websites and my only restriction is that the websites limit the daily spend(website side... Although I guess a rogue AI could have changed it... )
Great example of performative enterprise security practice that contributes to degraded security posture, I suppose. Best of luck.
What would happen if the director suddenly gets sick or decide not to come to work anymore? A lot of people assume that humans are reliable, they are not.
Exactly: limiting access is fine, lack of contingencies is not.
Some systems and services still only allow for one owner though (I'm not going to name names), which can be a big problem when MFA is mandated. From what the poster I responded to said, I'd be very surprised if that were the case for them though - just slightly daft policy.
3 replies →
One of my first boss called it the bus factor, not sure where the term comes from. What's the minimum number that need to get hit by a bus before it's impossible to keep things running. He used to say "you always have some bus factor, but it should never be one unless you're alone, otherwise you deserve whatever crap is going to rain on you someday".
I've found that to be incredibly true in my career.
3 replies →
My team rotates 1 sacrificial member every week to be on call with prod k8s access. It limits who can just push things to prod at any given time while making sure everyone on the team has experience. If someone is out sick or on vacation we do time trading, it works out for everyone.
Have lived this when a seeming healthy mid-30s man dropped dead. Nightmare.
Implemented a lot of “just in case” policies after that, which seemed obvious but oh well.
Use the exploit to gain access, then upgrade
Let's hope he didn't go skydiving. Seriously, you need to improve your processes.
where do you work? >:)
With AI agents, I've been using sites/services that are bot friendly and don't require MFA.
Not everything needs hyper security. Heck, I've given AI access to spend money on websites and my only restriction is that the websites limit the daily spend(website side... Although I guess a rogue AI could have changed it... )