Most of us know about the principle of least privilege. After I wrote about network segmentation recently, I'd hope that most of us know that limiting access to production data from all workstations might also be a good idea. Many of us also know that unusual patterns of access might indicate an issue. I wonder how many of us have a system in place to look for unusual access, especially this is something that might help us prevent, or at least detect, potential hacking activities. I wonder if we'll get to the point where we need to do more and not only implement better auditing of system, but also data access. Will we need to actually monitor what data is accessed and ensure there is a valid need to do so? That was probably needed in this case, where various employees accessed a woman's DMV data for who knows what purposes. This is a creepy story, and I'd hope that it's the rare man that actually does this in any company, for any kind of data. Read the rest of Fines for Data Access