-2

In my life, I have spent a lot of time thinking and wondering about many things related to larger businesses, even though I have no direct connection to that world. By "larger", I mean "not just a single carpenter or him and his brother". Primarily, I'm talking about the kind of company which has a "board" of people, or at least a CEO in an office and a secretary and whatnot.

I often fantasize about how all the numerous things that a company is involved with, or own, or need to deal with internally, is kept track of. If I were starting a company today, the first thing I would do would be to create a database table called "company_log", and then create a small web interface for me to be able to easily add new records to this log, or display/search existing ones, with clear timestamps recorded.

I would then, whenever I did anything in regards to the company, write this down as a "post". Naturally, this database would be backed up in multiple copies regularly, encrypted and put in a fireproof safe. Some examples of what I imagine the posts would look like:

[timestamp] Bought new master computer from ACME, Inc. for $55,998.
[timestamp] Set up new master computer. Took 8 hours. Used Alice, Bob and Sue as my witnesses for security precautions.
[timestamp] Meeting about the design of the new robot arms.
[timestamp] Telephoned Something, Inc. about their prices for robot arm parts.
[timestamp] Decided to order the parts from Other, Inc.
[timestamp] Meeting about the launch campaign for the finished Robot Buddy.
[timestamp] Decided to postpone the launch due to unforeseen issues with the market.
[timestamp] Meeting about how to deal with the newly discovered competitor Evil, Inc.
[timestamp] Read in the news that Evil, Inc.'s warehouses had been mysteriously bombed during the night.
...

Basically, I would record every action that I consider in any way related to the company in a long log, so that I can later check back and know exactly what I did, when and why, and so that if I die unexpectedly, the entire company can theoretically (and practically) keep going as long as somebody goes through all the notes and thereby gets "up to date" with everything that has been done and could continue on where I stopped, even though they don't have my exact brain/mentality, but you get the point.

(Of course, this could "almost" as easily/conveniently have been done with physical papers in folders, which would have to be copied by the secretary or something for backups. This is what I expect they did before computers became feasible/reliable for this kind of thing. The point is still the same.)

I also would have a kind of "overview panel" with dynamic numbers showing the current "stats" of the company, such as "current employees" and all kinds of numbers related to the current finances and other important things like that.

Is this how they do it? Or do they consider it a risk to keep such a log, because it could be leaked or stolen or seized, giving hard proof of all the evil acts they do to make all that money?

Also, I guess the CEO/founder of the company would also have an incentive to "keep it all in his brain" instead of written down, even if in an encrypted, private database, because it makes him more valuable/indispensable?

It makes a lot of sense that a massive corporation like Disney or The Coca-Cola Corporation or something like that is going to have a whole physical vault, if not more, of very redundantly secured backups of their full "company log", both in digital and physical form. After all, the original founders are long dead and the companies are extremely large and make a huge amount of money every single day. You don't task stupid risks in that situation. I'm sure they must have all this written down carefully, probably in leather-bound folders in a secure, locked, guarded office in their main headquarters or something along those lines?

  • A few problems in your question: 1) if one were to do this in a large company, they wouldn't have time to actually do anything to enter into a log like this, 2) You appear to equate "making money" with "evil acts". This is not an appropriate assumption to make. There are lots of legitimate reasons why business decisions are kept secret. 3) No CEO is involved in all that in a company. You appear to not understand how even medium-sized companies function. In the end, this doesn't look like a security question, but you first need to understand how a business operates. – schroeder Dec 21 '19 at 20:33
1

In a large company, all those things are done in different ways, by different processes and by different people.

You have described in each of your examples:

  • change management
  • configuration management
  • risk management
  • threat intelligence
  • vulnerability management
  • governance
  • audits

And I'm not sure why one would think that all of that would be in one log, let alone one physical log ...

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.