Читать книгу You CAN Stop Stupid - Ira Winkler - Страница 37

While you can expect end users to make mistakes or be malicious, you do not have to enable the mistakes or malice. Unfortunately, some technology teams are doing exactly that. It is a given that users have to be able to perform their required business functions. However, you can design a user's access and function to limit the amount of loss they can initiate.

As we discussed earlier, McDonald's eliminates the possibility for cashiers to steal or miscount money by removing the cashier from the process. Similarly, ransomware is a constant problem for organizations, but that problem can be greatly reduced by not providing users with administrator privileges on their computer systems. Without administrator privileges, new software, even malicious software, cannot be installed on a computer.

There are limits to any measures that you employ to reduce user enablement. Some malware can bypass administrator privileges. While the elimination of cashiers eliminates risk of cashier theft, it also increases the risk posed by the people maintaining the kiosks, including those who count the cash collected by the kiosks. Even so, there is a significant reduction in the overall risk.

Just as users rarely need administrator privileges on their computers, they are frequently provided with much more technological access and capability than they require to do their jobs. In one extreme example, Chelsea Manning was a U.S. Army intelligence analyst in an obscure facility in Iraq. Manning was allowed to download massive amounts of data from SIPRNet, which is a communications network used by the U.S. Department of Defense and U.S. Department of State for data classified up to the SECRET level. Manning had access to data well beyond what her job function required. Some might argue that Manning's excessive access was part of an effort to ensure intelligence analysts had access to needed information and that compartmentalization of data was a contributing factor in the 9/11 failures. However, in the case of Manning, such access was not implemented with the appropriate security controls (see abcnews.go.com/US/top-brass-held-responsible-bradley-mannings-wikileaks-breach/story?id=12276038). After all, the United States has been dealing with insider threats since Benedict Arnold. Examples like Manning's excessive information access are not unique to the military, and they're often even worse in commercial organizations.

In college, author Ira Winkler worked for his college's admissions office and was responsible for recording admission statuses in the college's mainframe computer. He realized that he also had menu options that provided access to the school registrar's system, which maintained grades. Although he never abused the access, you can assume that other people were not as ethical. You can also assume that many people in other university offices with access to legitimate functions also had excessive access privileges. As you can see, such information access is a combination of both technology and process.

In short, any time a user is provided with the ability to access information or perform tasks more than is required for their work, there is a risk to potentially be contained. Sometimes, expanded information access and enhanced capabilities can help empower people to do their jobs more effectively. Empowering users to succeed while reducing loss is always about finding the right balance. For example, there is no reason for employees to have access to other people's PII, unless their job specifically requires such access.