Hacker News Reader

Comment by phkahler | Hacker News Reader

Database use can NOT be limited by policy. If the data is there, people with access to it WILL use it for whatever they want, even if that's simply because nobody told them what the restrictions are.

The best way to prevent misuse of data is not to have it. The second best way is to only allow access through technical means with proper access control at the query level and never access to the raw data.

View on HN

idk, I would say that at least in healthcare, most people are sufficiently terrified of the consequences of HIPAA violations that they won't access records they aren't supposed to. In this case, what works is a combination of serious, career-ending consequences and the knowledge that compliance departments conduct regular audits of everyone's access logs.

In Germany, there's a random audit of about 10% of queries iirc. Scandals still happen, but police officers get fired for it, and the chance of discovery and the consequences are both high enough that it's probably not as much of a problem over here.

Damn. It must be nice. Here in the US we struggle to hold police officers accountable for not shooting civilians.

I have hope that the culture around policing will change if people finally realize that the crime rates have dropped. But with fear of crime being a great lever with which to control people's vote, I don't see it happening anytime soon. The population is too vast, outliers too common, and ignorance of statistics too widespread. It will always be easy to convince people that some place they know nothing about is a Mad Max hellscape and that it's coming for them.

> most people are sufficiently terrified of the consequences of HIPAA violations that they won't access records they aren't supposed to

And the rest access records they aren't supposed to: https://www.hipaajournal.com/hipaa-training-survey/

Every police department I've heard of harps on what the restrictions are. They should 100% know.

But how are you going to put an access control in that can tell you if an officer is searching a drunk driver's plate or an ex's? They need access to data quickly. They're already logging who accesses what, which is how they know who abused it and can punish such people, but some things are hard to fix with a technical solution.

The problem is that if someone has access to query at all, they can abuse it.

How do you limit to specific search strings? Is that a thing?

An interface that accepts only certain things - not raw SQL - and only returns whats needed for the task at hand. Logging of who asked for what is good too but is not preventative.

Database roles are a thing

But DB roles arent case specific. Someone with access to personal records should only be able to query relevant and legal information about the current case at hand. This requires oversight.

Yes. Ultimately I agree this is a social and legal construct, and technology cannot feasibly be configured to enforce it

One of the very few good reasons for in-database logic, such as views and stored procedures is rule enforcement - this allow queries to return only the data you are authorized to see. Doing this across multiple databases on multiple organizations is challenging, but, where I live, we all went through that with GDPR and we are quite good at preventing unauthorized access.

In the end, it feels like nobody (and nothing) can see the whole dataset.

I the industry, we have a monthly refresher training to not forget tne simple fact that checking the balance of your ex account on a production database, however tempting it is, will meam you dont work in the industry anymore

There are lots of ways to flag abuse - the most basic one is tagging each access with a valid authorization for that specific data. Using a law enforcement example, if I am investigating a drug-related crime, a search for data on a record that was never searched before or after (or only searched by me) is a very good predictor for abuse.

Reply on news.ycombinator.com