Code security - how to protect aginst malevolent programmers
How to protecting you application from outside world is widely debated across the internet and also in Stack Overflow.

But danger may also come from you development team. When small/medium company recruits evil programmer then its in heap of trouble.

I think that is highly unlikely for average web development company (or any small company that deals with non "critical" stuff) to actually hire someone hell bent on harming them.

This changes with banks, medical/biotech companies, military contractors and also in other fields.

Lets say that agent is already in and is tasked with building backdoor directly into bank application that bypass role hierarchy or whatever.

I guess this is real problem that (especially) financial institutions must deal with on daily basis.

What does they do to solve this problem?

Links to articles/literature will be highly appreciated.
Code security - how to protect aginst malevolent programmers
===

How to protecting you application from outside world is widely debated across the internet and also in Stack Overflow.

But danger may also come from you development team. When small/medium company recruits evil programmer then its in heap of trouble.

I think that is highly unlikely for average web development company (or any small company that deals with non "critical" stuff) to actually hire someone hell bent on harming them.

This changes with banks, medical/biotech companies, military contractors and also in other fields.

Lets say that agent is already in and is tasked with building backdoor directly into bank application that bypass role hierarchy or whatever.

I guess this is real problem that (especially) financial institutions must deal with on daily basis.

What does they do to solve this problem?

Links to articles/literature will be highly appreciated.