Hacker News Reader

Comment by xyst | Hacker News Reader

It may be a requirement or law depending on where the company does business.

For example, the financial companies I used to work for had a “standard practice” of archiving all e-mails and internal chats for 7-8 years. Not sure if phone calls on company equipment were recorded or retained though (may be a YMMV case).

This is why I separate work and personal assets. I never do work on personal devices nor do I use work devices for personal activities (ie, social media, e-commerce, shit posting). Also if I’m shit talking the boss’s boss. It’s never using work devices.

Have been asked a few times to use personal devices for work but absolutely refused. I would be asked to install their invasive spyware and root kits so they can abide by their draconian corporate policies. So far, they haven’t forced me otherwise I would have quit those companies long ago.

View on HN

Requirement to log doesn't mean the record has to be in online storage though. It could easily get rotated into cold storage every month with only a unique offline password granting you access.

> Requirement to log doesn't mean the record has to be in online

Banks are (or were) required, in America, to use write-once offline media for records [1].

[1] https://en.m.wikipedia.org/wiki/Write_once_read_many

I think the word "easily" is carrying a lot weight here -- for a company the size of Disney, keeping all internal communication records in secure offline storage sounds pretty hard from both a technical and operational standpoint. Certainly doable, but I doubt it'd ever happen unless it were required by law

I guarantee you that large-cap, highly scrutinized public companies comply with much harder regulations and internal controls than this.

There are various levels of offline. For example you can have an S3 bucket with write-only access. No, it's not perfectly offline. But it's isolated from both vulnerabilities and from hacked employees, which covers most common types of breaches. You can solve 99% of the offline storage features without having an actual physical location with tapes.

what about hacked employees' aws accounts?

Unless they're highly privileged enough to turn on read access to the bucket, you're fine. Thus, you can contain most breaches of credentials.

Employees shouldn't have default access to those credentials. This applies to audit/backup/account management/billing privileges. You can have very dedicated roles with lots of restrictions for those specific things.

If the organisation doesn't use SSO coupled with MFA and the enforcement of the least amount of privileges principle on a cloud platform, then they have no right to complain about security breaches.

Have you ever worked for a company larger than a 3 person startup? When you work at a company with hundreds of thousands of people, how can you “easily” move data into cold storage without destroying employee productivity? Don’t be hand wavy. Be specific about your solution.

Do you move all old files, emails, internal knowledge articles, code repos, chat messages, etc etc to cold storage? You can’t search for anything you’re looking for in OneDrive, Outlook or Slack if the data is in cold storage so are you going to develop custom applications to support the same search filters as each original source application, but which searches your cold storage?

Once a user finds something in cold storage, you have to load it back into the SaaS app to display it. Why? A variation of the following applies to all enterprise data: A Slack message has tons of important metadata tied to it besides the text content. For example Slack user Id of the message sender, channel ID it was in, file ids of any file attachments in the message, and so on. How do you load that back into Slack from your cold storage?

You can put any data in cold storage. In the real world, that often makes the data almost useless for employees.

Does Cisco AnyConnect fall into the invasive spyware root kit category?

A corporate VPN on a personal device definitely does.

> for 7-8 years. Not sure if phone calls on company equipment were recorded or retained though

For a front office role - archiving of; emails, internal chats, external chats, phone calls / squawk lines, browser history, pc screenshot every X interval, same for work laptop at home. Office cctv, room microphones, mobile phone calls + text messages + device monitoring to ensure no other apps.

> I never do work on personal devices nor do I use work devices for personal activities

This is now the way.

> Also if I’m shit talking the boss’s boss. It’s never using work devices.

It's wild that some don't get this. A couple years back some employees at my company were fired for doing just this over the same IM system we used to coordinate everything else.

or you buy a shitty phone for the company crapware and leave it at your desk when you go home.

The company should pay for that phone

Reply on news.ycombinator.com