Newsgroups: bit.listserv.cumrec-l
Date:         Wed, 30 Sep 1992 09:52:51 GMT
From:         Roy Martin <CCSYS005@CCSUVM1.BITNET>
Subject:      Programmer Access to Production files

In response to DON WATSON:

Don Writes:

>     I have been surprised reading the replies to your request to
> see how many universities give programming staff access to
> confidential production files. There seems to be some concern about
> protecting the university against the programmer, who signs a form,
> but none about protecting the programmer, who would be subject to
> suspicion if data were altered. I cannot see how an administrative
> department can be responsible for data if another department can
> alter it.
>      The reasons that were given for doing it seem largely
> nonsense . . .

Don's point on protecting the programmer, should a question of altered
data arise, is a valid one.  I am afraid to admit that my prior response
to this discussion was a bit cavalier when I said that all production
programmers here at CCSU have full access to production data.  I do
admit that in doing that, we, (there are three of us), are left with
very little protection if such a question arises.

I do think that each programmer SHOULD be required to sign a statement
informing them of the confidentiality issues involved in working
with student information.  BUT, that document should also state that it
is the responsibility of the university at large, not the individual
programmer, to create mechanisms to protect the confidentiality of that
data.  Cases in which programmers knowingly and inappropriately alter
data are clear-cut: the programmer is wrong and liable.  The programmer
should not be liable, though, if some listing containing student GPA's
isn't shredded as it should be, and ends up in the hands of the local
student newspaper: the programmer should be protected against that.
In many cases, though, simple mechanisms such as audit trails, and
time stamps will provide most of the protection, (for and against),
the programmer.

The situation, though, in many cases is moot.  Here at CCSU we have
three programmers to handle all of the student information, financial
aid, billing, etc.  That's it.  And we are CONSTANTLY in development
mode.  Except for one harried systems programmer, (who's too busy
keeping VM running to much care whether the rest of us sink or swim),
we have no other staff.  We have too many things to do.  It is simply
too time consuming to constantly be creating test databases, requesting
access to live data, requesting access to source code, etc, etc.  We
would only accomplish about half of the development we currently do.
True, it occasionally leads to some sloppy analysis, but at least
the analysis does get done.

Perhaps our situation is unique, but I think not.  Most institutions
are trying to do more with less.  Thus, this question of security
becomes an interesting academic debate, but for universities like CCSU
it is just that: academic.

||-------------------------------|-----------------------------------||
||   Roy Martin                  |  CORPUS CHRISTI STATE UNIVERSITY  ||
||   Programmer/Analyst &        |  6300 OCEAN DRIVE                 ||
||     GOD (Guardian Of Data)    |  CORPUS CHRISTI, TX  78412-5599   ||
||                               |     PHONE: (512) 994-2693         ||
||   CCSYS005@CCSUVM1            |     FAX:   (512) 994-2366         ||
||-------------------------------|-----------------------------------||
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU