Informing mgt their security is leakier than Luisa Zissman's fanny rag

[Gym beast]

Conundrum....


A) Righteously email management, which creates a electronic chain of evidence that by definition MUST be pursued, whipping up some discontent, risking antagonising HE WHO SIGNS MY TIMESHEETS, or;


B) Drop a quiet word in the meeting room, knowing full well if I tell them verbally, nothing will be done, then walk offsite in a few months with much fatter pockets, but knowing a big brand name who are in the business of safeguarding lives can't even completely safeguard their data?


WWYD ???

[Ticktock]

Besides telling them about it, can you do anything to sort things that will make you money?

[EternalOptimist]

It's a no brainer. If lives are at stake you have a moral obligation, at least, to step forward and make your case in the email.
Obviously this will lead to a lot of angst, problems and antagonism and ultimately your sacking, but that is a price worth paying.
Then nothing will be done and your valuable insight will be missing, ergo the chances to save lives will be immensly reduced. So dont send that email. Its a no brainer

[CheeseSlice]

Are you a security expert? Is it your profession?

[Gym beast]

Besides telling them about it, can you do anything to sort things that will make you money?

Like what dude? Blackmail them into a rate rise ???!??!!!?!!?

They'd possibly extend but I'd rather go for a higher rate elsewhere with my newly enhanced skillset.

[DaveB]

The key to getting management on board with security issues is to point how how it will either *save* them money if they fix it, or *cost* them money if they don't.

You have to couch it in business terms they will understand and see as relevant to them. Just telling them that they have a technical vulnerability in an application relating to a buffer over flow leveraging a cross site scripting exploit (or whatever the problem is) will not get them to take notice, even if they are the IT manager or Director. It will just irritate them.

You can also throw in the upcoming changes to legislation coming from Europe that will mean increased accountability for data security, introduce legal requirements to report data loss incidents with 24 hours and introduce new sanctions against those that fail to protect information appropriately.

Full review from a Specialist legal firm here: https://www.slaughterandmay.com/medi...ion-reform.pdf there are lots more if you look for them, all saying the same thing.

[Ticktock]

Like what dude? Blackmail them into a rate rise ???!??!!!?!!?

They'd possibly extend but I'd rather go for a higher rate elsewhere with my newly enhanced skillset.

No dude. Like is it something that you have the skills to be able to fix?!?!?!?!?!?!?!?!?!?!
So you can not only tell them about the problem, but also sell in a solution. Hardly blackmail - they can take you up on the offer or they can source a fix elsewhere.

In any case, I fail to understand why telling your client "I've spotted a potential issue, here are the details" would get you fired. Perhaps it's because I generally have a fairly decent relationship with my clients.

[Pogle]

Like what dude? Blackmail them into a rate rise ???!??!!!?!!?

They'd possibly extend but I'd rather go for a higher rate elsewhere with my newly enhanced skillset.

With your frankly bizzare thread title and use of the word 'dude', i can only assume you're a pillock or a 15 year old boy.

[d000hg]

Is submitting it anonymously an option, as a letter or something like that?

[northernladuk]

With your frankly bizzare thread title and use of the word 'dude', i can only assume you're a pillock or a 15 year old boy.

Snorted my coffee reading this one!