Question

I’ve always wonder what security mechanisms are there to prevent an employee (dba, developer, manager, etc.) from modifying users’ data. Let say a user has a Facebook account. Knowing who database works, I know that at least two employees in that company would have root access to it. So my question is what if such employee decides to alter someone’s profile, insert bad or misleading comments, etc.?

Any input is appreciated. Thanks.

Answer 1

If a person has full write access to a database, there is nothing preventing them from writing to that database. A user who has unrestricted access to Facebook’s database engine has nothing other than company policy to prevent them from altering that data.

Company policy and personal honor are usually good enough. In the end, though, there’s always that risk; a Google employee was fired in July for reading users’ private account data. In short, the people who write software for a system can make that system do whatever they like, and there is absolutely no way to prevent this; people who can read a source of data can read that source of data, and people who can edit it can edit it. There is no theoretical way to prevent this from being the case.

In short, all that can be done is to have more than one person watching the database, and fire people who try to damage it. As a user, all you can do is trust the company that controls the data.