All excellent points. I never worked at those scales or under those conditions, neither should I have been permitted to. And I had enough self-awareness to keep myself away from anything like that.
I guess when I read about this breach or that, the real damage seems to be a result of not having the basics covered. Whatever “basic” might mean for different scales of operation, encrypted at rest seems to be the the basis of public harm through theft of data, and it strikes me that if that can’t be managed at a particular scale, then operating at that scale should not be considered.
Did you remember to plan for a zero downtime encryption key rotation?
Did you know when account passwords expire? Have you thought about password rotation?
That sounds like a good practice until you have 20 (or even 2000) backend server requests per end user operation.
All of those are taken from my experience.
Security is like an invasive medical procedure: it is very painful in the short term but prevents dire complications in the long term.
All excellent points. I never worked at those scales or under those conditions, neither should I have been permitted to. And I had enough self-awareness to keep myself away from anything like that.
I guess when I read about this breach or that, the real damage seems to be a result of not having the basics covered. Whatever “basic” might mean for different scales of operation, encrypted at rest seems to be the the basis of public harm through theft of data, and it strikes me that if that can’t be managed at a particular scale, then operating at that scale should not be considered.