1

Let's say I'm building a system, similar to a very simple ecommerce.
Users can sign up as consumer and start buying products.

Purchases are then stored in the database together with the order status, shipping info, etc.
Now, in order to manage users and resources, admins can access to the admin panel of the application instead of directly accessing the database, using the APIs provided by the system.

My question is: to what extent admins should be able to manage customers' info, details and resources?
For example, an admin should have the ability to "lock" a user account or to manually send a "reset password request" to a specific users, through the APIs. But should an admin also be able to modify other resources like user personal details, shipping addresses, or the status of an order (from "PROCESSING" to "ENDED" for instance)?

How can I properly (and securely choose) what functionality should be accessible by admins through APIs, and what should be accessible by an highen-level user, like the developer itself, doing staff directly from the db?

1
  • 2
    What some admins, developers or "higher-level users" should be able to do or not depends on your business processes on on the role the various employees have in these. Security policies then can be modeled to support these business processes. Not the other way around. So this is not a security question. Apr 18, 2023 at 3:30

1 Answer 1

0

...an admin should have the ability to "lock" a user account or to manually send a "reset password request"

Should they? Isn't that the role of an account admin, not a system admin? In that case, of course an account admin should not modify user records or order records. Those should be under "help desk" and "order admin roles", respectively.

And developers should not have access to any live data. They should only work on sanitised data from the app, and code changes pushed through a CI/CD pipeline to keep the devs away from sensitive data and live data to prevent leaks or order flow disruption.

Do you see where I'm going with this? The main idea is to employ the "Principle of Least Privilege and Least Functionality". But how that looks in any given context will depend entirely on the business needs of the organisation.

If you only have one person doing admin and dev work, then the "least" is "everything".

There is no single answer for how this should look in every context. You do a risk assessment for the people who need to do work and give them the least amount of rights and access they need to do the work you have assigned to them. You want to protect the system and the data from misuse/abuse from authorised people, and limit the impact of compromised accounts or access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .