As a developer, I assumed that database administrators had access to all data of an application, including confidential data, and that nothing could be done about it. But this claim has not been true for 15 years. Nowadays, reading, editing, or deleting personal, financial, or health data can also be blocked for administrative accounts. This allows database administration to be outsourced while simultaneously avoiding the risks of data exfiltration or unintentional changes.
To date, I have seen too few companies that have implemented this blocking, and I wonder why that is. Most database administrators and DevOps do not know about this possibility. While logging access to personal and financial data is recommended as a security measure to fulfill GDPR and DORA requirements, it is only recommended to give each employee only the rights they need for their work. In practice, this recommendation does not affect administrators, although solutions exist to restrict their permissions. Auditors’ recommendations typically do not mention anything concrete on this case.
Have you worked at companies that have blocked database administrators’ access to confidential data? Why do you think the majority of companies do not implement measures against the risk of credential theft from administrators?