1

What do you guys do (system/framework wise) to safeguard things like

  1. employees writing malicious code to destroy your server
  2. employees reading all your database sensitive information
  3. generally programmers that have access to your back-end and potential damages that they can do.

Is there any PHP scripts that guards against these, etc.?

Felix Kling
  • 795,719
  • 175
  • 1,089
  • 1,143
Patrick
  • 11
  • 1

1 Answers1

8

1) employees writing malicious code to destroy your server

2) employees reading all your database sensitive information

Don't grant employees access to the server except for whatever front end application they are using. (Assuming "Employees" being people who use the company's software, not create them.)

3) generally programmers that have access to your back-end and potential damages that they can do.

That is near impossible to achieve. If you can't trust your programmers not to do damage to your back-end, you need new programmers. End of story.

You can do things like restrict access rights to parts of the code, enforce a strict access control list, have people work only on the code parts they are assigned to, and so on. But the basic rule in the vast majority of projects is: If a programmer wants to do damage, they can. Especially in PHP.

That may be different in huge projects like Windows, or the Linux Kernel, where any code checked into the central repository is monitored closely. But I don't think we are talking about those kinds of dimensions here.

Related questions with a lot of additional input (and suggestions for actual technical measures, if you want to employ those):

Community
  • 1
  • 1
Pekka
  • 442,112
  • 142
  • 972
  • 1,088
  • Yep - the only way to deal with a programmer you don't trust is to replace them with one you do. But before you do that, have your back end programmers actually done anything to abuse your trust? Another approach is to write the serious back end stuff as a seperate component, with seperate DB credentials, yourself. But as a professional myself I wouldn't work from outside the circle of trust... – Martin Milan Mar 30 '10 at 16:18