Informing mgt their security is leakier than Luisa Zissman's fanny rag

[mudskipper]

With your frankly bizzare thread title and use of the word 'dude', i can only assume you're a pillock or a 15 year old boy.

Or a sockie. Didn't nob25 do the dude thing?

[darmstadt]

Post the information anonymously on the 'net and see the company sink, serves them right

[Bellona]

The key to getting management on board with security issues is to point how how it will either *save* them money if they fix it, or *cost* them money if they don't.

You have to couch it in business terms they will understand and see as relevant to them. Just telling them that they have a technical vulnerability in an application relating to a buffer over flow leveraging a cross site scripting exploit (or whatever the problem is) will not get them to take notice, even if they are the IT manager or Director. It will just irritate them.

You can also throw in the upcoming changes to legislation coming from Europe that will mean increased accountability for data security, introduce legal requirements to report data loss incidents with 24 hours and introduce new sanctions against those that fail to protect information appropriately.

Full review from a Specialist legal firm here: https://www.slaughterandmay.com/medi...ion-reform.pdf there are lots more if you look for them, all saying the same thing.

WDBS
Email them the problem, the consequences, and, if you have one, the solution.
Couched professionally it should be rewarded rather than punished: and if it is the latter then walk.
My reputation and conscience would make it the only way to go - especially, as you intimate you don't want to stay there anyway.

[d000hg]

Snorted my coffee reading this one!

Did you read about people snorting Coke and think "hey, any caffeinated beverage will suffice?"

[Pondlife]

Or a sockie. Didn't nob25 do the dude thing?

Maybe it's Keanu Reeves from the late 80s using the time machine from the Bill & Ted films.

[vetran]

as DaveB said.

Write a professional email highlighting the issues and their possible impact with rough idea of cost. Suggest if possible a solution and rough idea of cost & benefits.

there are plenty of good studies out there from people like Gartner / Forrester covering most common security issues. pick some nice scary & appropriate graphs.

the key point if their is a legal side is you reported it, saves you being the fall guy if the company gets caught.

[SimonMac]

Conundrum....


A) Righteously email management, which creates a electronic chain of evidence that by definition MUST be pursued, whipping up some discontent, risking antagonising HE WHO SIGNS MY TIMESHEETS, or;


B) Drop a quiet word in the meeting room, knowing full well if I tell them verbally, nothing will be done, then walk offsite in a few months with much fatter pockets, but knowing a big brand name who are in the business of safeguarding lives can't even completely safeguard their data?


WWYD ???

Depends if its "real" security or "ClientCo" company confidential?

Either way unless you know exactly what you are talking about you are heading for hot water, I would do neither, I would have a quite word with InfoSec team and raise it to them, they will assess the actual risk as is their job, and if they raise it to management it will carry more weight than some contractor.

[Gittins Gal]

Luisa Zissman?

Someone gonna tell me of am I going to have to google that?

[Pondlife]

as DaveB said.

Write a professional email highlighting the issues and their possible impact

Gym Beast’s most excellent email

Dude, we've like totally got a problem with our data security. It’s like people could find out about the babes n stuff and that would be like most most heinous. If that happens I’d be like, “dude, i totally told you this would happen” and you’d be like “no way!” and I’d be like “way!”

[SimonMac]

Did you read about people snorting Coke and think "hey, any caffeinated beverage will suffice?"

You should never snort Coke, the bubbles get up your nose