Ttdfjt

Why does Intel's Haswell chip allow FP multiplication to be twice as fast as addition?

What are the uses and limitations of Persuasion, Insight, and Deception against other PCs?

Improving software when the author can see no need for improvement

How to use grep to search through the --help output?

Why should we care about syntactic proofs if we can show semantically that statements are true?

Why did the RAAF procure the F/A-18 despite being purpose-built for carriers?

Drawing complex inscribed and circumscribed polygons in TikZ

Which likelihood function is used in linear regression?

How can you evade tax by getting employment income just in equity, then using this equity as collateral to take out loan?

Are there any differences in causality between linear and logistic regression?

How quickly could a country build a tall concrete wall around a city?

Visa National - No Exit Stamp From France on Return to the UK

Am I overreacting to my team leader's unethical requests?

In reversi, can you overwrite two chips in one move?

In Pokémon Go, why does one of my Pikachu have an option to evolve, but another one doesn't?

How can I iterate this process?

Accidentals - some in brackets, some not

Team goes to lunch frequently, I do intermittent fasting but still want to socialize

English - Acceptable use of parentheses in an author's name

Invert bits of binary representation of number

Optimal way to extract "positive part" of a multivariate polynomial

Dropdowns & Chevrons for Right to Left languages

Why "ch" pronunciation rule doesn't occur for words such as "durch", "manchmal"?

What does "sardine box" mean?

Employer stores plain text personal data in a 'data warehouse' [closed]

Is Creating a Restricted Database User in Microsoft SQL Server Decent ProtocolBest security practices for software development and release?Building a web app with encrypted MySQL database entries?How to securely provide data to a web server using a data warehouse?Secure database password stored in an env variableGet data file off critical database hostHow can releasing the text of an SQL query compromise security?Working on sensitive data on the cloudStoring customer data securely (compliance)How can I create a dummy DB for developer? (original has many tables and values like decimal int text)

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;

9

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, for various purposes. This data warehouse (as far as I can tell) has two or three environments; Dev, QA and Production.

I was recently granted access to the development data warehouse SQL server for a software development project I am working on.

I had to request permission to gain access to this data warehouse server. I only have access to the development server and as I was browsing through the tables to find the one required for my project, I came across the ones which contain sensitive data. Being curious, I ran a simple 'SELECT TOP 1000 ROWS' query and it came back with the sensitive employee data from 2012-2013, in plain text (including National Insurance Numbers, Next of kin details, qualification details, addresses, phone numbers, car registrations etc.).

This development server is accessed by a number of developers within my organisation (including myself) for various projects.

1) I don't think this data should be stored on the development environment (I believe everything was copied back from Production server at some point).

2) I don't think these details should be stored in plain text for anyone to see via a simple SQL query.

3) I don't believe that myself and other developers within the organisation should have free access to these tables.

I'm fairly certain that my employer is not aware of this and are actually storing all of this information in plain text, in the production environment. I also think that this breaches some sort of privacy or GDPR law.

I've spoken to my manager about this but they seem to be glossing over it and ignoring the issue/ not wanting to get involved.

How do I report this without getting into trouble myself, for viewing these tables? And who do I report to?

privacy databases sensitive-data-exposure exposure

share|improve this question

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

closed as off-topic by Conor Mancone, MechMK1, Xander, forest, Benoit Esnard Jul 31 at 7:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "This question does not appear to be about Information security within the scope defined in the help center." – Conor Mancone, Xander

If this question can be reworded to fit the rules in the help center, please edit the question.

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Does your organization have a Data Protection Officer? I'd try to reach out to her and talk about that issue in private.
  
  – mhr
  Jul 30 at 12:36
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  "How do I not get into trouble?" isn't really something we can help with. That depends on your company culture, unions, corporate policies, local laws, etc. You have also not explained how or why you opened the tables or what restrictions there were.
  
  – schroeder♦
  Jul 30 at 13:00
  

  
  
  
  


• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  Because that is your only question here, I'm wondering if this is a question better suited to Workplace.stackexchange.com
  
  – schroeder♦
  Jul 30 at 13:02
  

  
  
  
  


• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  I agree with @schroeder Currently there isn't a security question here - just a question about how to address a security problem in a workplace. That's mainly a question for workplace.stackexchange.com. As a frequenter of workplace.stackexchange, there are also many questions just like this over there. You could post this there, but you can probably also answer your question by just searching through related answers there.
  
  – Conor Mancone
  Jul 30 at 13:52
  

  
  
  
  


• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  This question belongs on The Workplace and should be migrated.
  
  – MechMK1
  Jul 30 at 16:08
  

  
  
  
  

 | 
show 3 more comments

9

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, for various purposes. This data warehouse (as far as I can tell) has two or three environments; Dev, QA and Production.

I was recently granted access to the development data warehouse SQL server for a software development project I am working on.

I had to request permission to gain access to this data warehouse server. I only have access to the development server and as I was browsing through the tables to find the one required for my project, I came across the ones which contain sensitive data. Being curious, I ran a simple 'SELECT TOP 1000 ROWS' query and it came back with the sensitive employee data from 2012-2013, in plain text (including National Insurance Numbers, Next of kin details, qualification details, addresses, phone numbers, car registrations etc.).

This development server is accessed by a number of developers within my organisation (including myself) for various projects.

1) I don't think this data should be stored on the development environment (I believe everything was copied back from Production server at some point).

2) I don't think these details should be stored in plain text for anyone to see via a simple SQL query.

3) I don't believe that myself and other developers within the organisation should have free access to these tables.

I'm fairly certain that my employer is not aware of this and are actually storing all of this information in plain text, in the production environment. I also think that this breaches some sort of privacy or GDPR law.

I've spoken to my manager about this but they seem to be glossing over it and ignoring the issue/ not wanting to get involved.

How do I report this without getting into trouble myself, for viewing these tables? And who do I report to?

privacy databases sensitive-data-exposure exposure

share|improve this question

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

closed as off-topic by Conor Mancone, MechMK1, Xander, forest, Benoit Esnard Jul 31 at 7:48

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "This question does not appear to be about Information security within the scope defined in the help center." – Conor Mancone, Xander

If this question can be reworded to fit the rules in the help center, please edit the question.

• 
  
  
  

  
  2
  

  
  
  
  
  
  

  
  
  Does your organization have a Data Protection Officer? I'd try to reach out to her and talk about that issue in private.
  
  – mhr
  Jul 30 at 12:36
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  "How do I not get into trouble?" isn't really something we can help with. That depends on your company culture, unions, corporate policies, local laws, etc. You have also not explained how or why you opened the tables or what restrictions there were.
  
  – schroeder♦
  Jul 30 at 13:00
  

  
  
  
  


• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  Because that is your only question here, I'm wondering if this is a question better suited to Workplace.stackexchange.com
  
  – schroeder♦
  Jul 30 at 13:02
  

  
  
  
  


• 
  
  
  

  
  4
  

  
  
  
  
  
  

  
  
  I agree with @schroeder Currently there isn't a security question here - just a question about how to address a security problem in a workplace. That's mainly a question for workplace.stackexchange.com. As a frequenter of workplace.stackexchange, there are also many questions just like this over there. You could post this there, but you can probably also answer your question by just searching through related answers there.
  
  – Conor Mancone
  Jul 30 at 13:52
  

  
  
  
  


• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  This question belongs on The Workplace and should be migrated.
  
  – MechMK1
  Jul 30 at 16:08
  

  
  
  
  

 | 
show 3 more comments

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, for various purposes. This data warehouse (as far as I can tell) has two or three environments; Dev, QA and Production.

I was recently granted access to the development data warehouse SQL server for a software development project I am working on.

I had to request permission to gain access to this data warehouse server. I only have access to the development server and as I was browsing through the tables to find the one required for my project, I came across the ones which contain sensitive data. Being curious, I ran a simple 'SELECT TOP 1000 ROWS' query and it came back with the sensitive employee data from 2012-2013, in plain text (including National Insurance Numbers, Next of kin details, qualification details, addresses, phone numbers, car registrations etc.).

This development server is accessed by a number of developers within my organisation (including myself) for various projects.

1) I don't think this data should be stored on the development environment (I believe everything was copied back from Production server at some point).

2) I don't think these details should be stored in plain text for anyone to see via a simple SQL query.

3) I don't believe that myself and other developers within the organisation should have free access to these tables.

I'm fairly certain that my employer is not aware of this and are actually storing all of this information in plain text, in the production environment. I also think that this breaches some sort of privacy or GDPR law.

I've spoken to my manager about this but they seem to be glossing over it and ignoring the issue/ not wanting to get involved.

How do I report this without getting into trouble myself, for viewing these tables? And who do I report to?

privacy databases sensitive-data-exposure exposure

share|improve this question

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

share|improve this question

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

share|improve this question

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

edited Jul 30 at 13:50

schroeder♦

84.4k3434 gold badges188188 silver badges227227 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

asked Jul 30 at 12:27

nopassport1nopassport1

4844 bronze badges

1 Answer
1

active

oldest

votes

9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization.

This should be the first place to report to.

share|improve this answer

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the reply. I will have to check who this individual is. How do I explain myself looking through this data? - it has no relevance to the project I am working on so I'm concerned about the fact that I have personally breached some sort of law or regulation
  
  – nopassport1
  Jul 30 at 12:50
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @nopassport1 If you feel apprehensive about saying that you looked, perhaps "The list of tables in SQL Server Management Studio included several, such as SENSITIVE_EMPLOYEE_DETAILS. Can you check that they do not contain real, non-encrypted data?" will do?
  
  – TripeHound
  Jul 30 at 13:24
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 If someone granted you access to data which is unrelated to your work, then that's another data protection blunder. But as a new user you have plausible deniability if you say that you didn't know which database tables are relevant to your project and which are not.
  
  – Philipp
  Jul 30 at 13:41
  
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 I'd also add that you had a reasonable expectation that the data within a development environment would not be "real" data. Typically development environments contain simulated or obfuscated data. (If you were browsing around in a production environment then you may well have broken at least a company policy.)
  
  – JDB
  Jul 30 at 21:17
  
  

  
  
  
  

add a comment | 

9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization.

This should be the first place to report to.

share|improve this answer

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the reply. I will have to check who this individual is. How do I explain myself looking through this data? - it has no relevance to the project I am working on so I'm concerned about the fact that I have personally breached some sort of law or regulation
  
  – nopassport1
  Jul 30 at 12:50
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @nopassport1 If you feel apprehensive about saying that you looked, perhaps "The list of tables in SQL Server Management Studio included several, such as SENSITIVE_EMPLOYEE_DETAILS. Can you check that they do not contain real, non-encrypted data?" will do?
  
  – TripeHound
  Jul 30 at 13:24
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 If someone granted you access to data which is unrelated to your work, then that's another data protection blunder. But as a new user you have plausible deniability if you say that you didn't know which database tables are relevant to your project and which are not.
  
  – Philipp
  Jul 30 at 13:41
  
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 I'd also add that you had a reasonable expectation that the data within a development environment would not be "real" data. Typically development environments contain simulated or obfuscated data. (If you were browsing around in a production environment then you may well have broken at least a company policy.)
  
  – JDB
  Jul 30 at 21:17
  
  

  
  
  
  

add a comment | 

9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization.

This should be the first place to report to.

share|improve this answer

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Thanks for the reply. I will have to check who this individual is. How do I explain myself looking through this data? - it has no relevance to the project I am working on so I'm concerned about the fact that I have personally breached some sort of law or regulation
  
  – nopassport1
  Jul 30 at 12:50
  
  

  
  
  
  


• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  @nopassport1 If you feel apprehensive about saying that you looked, perhaps "The list of tables in SQL Server Management Studio included several, such as SENSITIVE_EMPLOYEE_DETAILS. Can you check that they do not contain real, non-encrypted data?" will do?
  
  – TripeHound
  Jul 30 at 13:24
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 If someone granted you access to data which is unrelated to your work, then that's another data protection blunder. But as a new user you have plausible deniability if you say that you didn't know which database tables are relevant to your project and which are not.
  
  – Philipp
  Jul 30 at 13:41
  
  

  
  
  
  


• 
  
  
  

  
  7
  

  
  
  
  
  
  

  
  
  @nopassport1 I'd also add that you had a reasonable expectation that the data within a development environment would not be "real" data. Typically development environments contain simulated or obfuscated data. (If you were browsing around in a production environment then you may well have broken at least a company policy.)
  
  – JDB
  Jul 30 at 21:17
  
  

  
  
  
  

add a comment | 

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization.

This should be the first place to report to.

share|improve this answer

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

share|improve this answer

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges

answered Jul 30 at 12:40

PhilippPhilipp

45.8k88 gold badges119119 silver badges144144 bronze badges