the "hide vs delete" problem is incredibly prevalent in corporate financial statements.
Accountants during preparation of these documents often "hide" for a reason - they want to try out how certain numbers work, and want to keep their work-in-progress easily accessible without deleting them. And often corporate secretaries just send out these documents "as ready" without thinking that there's tons of confidential and sometimes very wrong (or very incriminating) numbers "hidden" as work-in-progress.
This happens so often on Quarterly financial statements that it's an embarrassment, frankly. Disclaimer: I worked as a lowly proofreader of financial documents, quarterly and annual reports, etc.
The problem is not Access Control. The problem is people failing to recognize when a document is "ready for public consumption" vs an internal working draft.
The real story of "lacking access control" is when these excel worksheets actually link into MS Access databases hosted inside the firewalls of these companies - and holes were poked in the firewall to let the data out because executives wanted to work on these documents in their lodge in aspen, etc.
I see this all the time - it's really freaky when the excel worksheet I was proofreading start reaching out over the net and into supposedly private networks deep within financial houses. If I run something like little snitch, it would show access attempts over nonstandard ports, etc.
Well, of course "it's always a people problem" as Jerry Weinberg says. But the Barclays example is interesting* precisely for its technical detail. The spreadsheet author used Excel's "hide" feature to hide some data. Had Excel given them the ability to restrict read access to some portion of the sheet, it seems obvious that they would have done that instead.
* Interesting to me at least, because I work on things like this. Not contradicting your comment at all.
Accountants during preparation of these documents often "hide" for a reason - they want to try out how certain numbers work, and want to keep their work-in-progress easily accessible without deleting them. And often corporate secretaries just send out these documents "as ready" without thinking that there's tons of confidential and sometimes very wrong (or very incriminating) numbers "hidden" as work-in-progress.
This happens so often on Quarterly financial statements that it's an embarrassment, frankly. Disclaimer: I worked as a lowly proofreader of financial documents, quarterly and annual reports, etc.
The problem is not Access Control. The problem is people failing to recognize when a document is "ready for public consumption" vs an internal working draft.
The real story of "lacking access control" is when these excel worksheets actually link into MS Access databases hosted inside the firewalls of these companies - and holes were poked in the firewall to let the data out because executives wanted to work on these documents in their lodge in aspen, etc.
I see this all the time - it's really freaky when the excel worksheet I was proofreading start reaching out over the net and into supposedly private networks deep within financial houses. If I run something like little snitch, it would show access attempts over nonstandard ports, etc.
It's scary.