Is there any good (or less bad) way to handle a web portal or website with awful security?

Question

Background:

I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As much as I'd like to, I can't ditch this site immediately, but am definitely moving towards doing so ASAP (within a few months at the outside, I hope). It is a very large portal in the US for accessing highly sensitive information over web - HR, financials, accounting and the like.

Problem:

Their security Sucks. A screenshot below, and note that the password is limit to 12 characters long. 7 to 12 character password, no special character set, and subverted by security[-eliminating] questions that are mostly answerable with a few public records searches and/or some decent Google-Fu. No checks to make sure the PC accessing it isn't infected with something nasty or anything like that, either, naturally.

Again, this is a very large, US-based portal for HR and financial information. If I wasn't so used to appalling security on the web, I'd be really pissed off, instead of just moderately angry and concerned. So far as I can tell, there is also no alternate authentication method, such as two-factor auth, the ability to disable the security questions, or use a password that might actually hold out for more than a few minutes against an attacker who knows what he's doing.

I don't have visibility into their behind-the-scenes security (password hashing, salting, penetration testing, vulnerabilities, etc.), but based on what I've seen so far, I bet that pulling back the curtain would only be more cause for concern/alarm.

Question:

1. What can I do to best secure myself while I have to tolerate this abomination?
2. What should I do regarding the fact that all this sensitive information for so many people is being guarded by such poor security polices? How should I notify, and what do I do when I get the canned we take security seriously, eff off response I know I'll get?
   • As theorized, pulling back the curtain would probably reveal some true horrors, but that seems like a bad idea.

I'm going to apply an answer to what I've done thus far to handle this from the standpoint of my personal security, but I'm not sure if I've done enough or missed anything I could be doing (given that I have to use this PoS) and would welcome your feedback.

I have no idea what to do regarding (2). My experience has been testing my own systems and fixing them, not stumbling across systems like this with worse security than my phone, backed by a massive corporation that will move slower than molasses uphill in winter (unless I do something stupid/out of line and they decide to sue me, in which case I bet they'll move really quick).

Answer 1

Self protection:

What you list in your answer sounds pretty good. About my only thought would be to change your long ranty fake security question answers to truly fake answers. Either sentences or more pseudo-random characters. But assuming you get somewhere with trying to change the system, I don't think you want those in there when some guy who is investigating and trying to help sees them. I never really suggest the strategy of "hope the admin has a sense of humor".

I'd also suggest a manual double check - it sounds like an an actual human accesses this account to look stuff up. Have the human make a physical log of when the account is accessed - start time/end time, and if you are really anal - work done. So that if an inappropriate access issue comes up, you have a separate list of what your activity has been. Best is something that provide an automated time stamp - for example, mail a mail to yourself through the company mail server - so you mail hits the logs and has a (slightly) well-documented time stamp (sent time/date). Yeah, it's fudgeable, but here's a limit to the number of reasonable checks a process can handle.

Long term protection:

OK, so I get that your pissed, but venting, ranting and otherwise sounding off at the site owners, on the web or to upper management in your own company is likely not to get you very far. When a pissed off guy comes storming onto the scene demanding everything be fixed Right This Minute, the people who might actually respond in a productive way will probably batten down the hatches and try to figure out how to get you out of their office, email thread, or website and spend more time eliminating you than eliminating the problem.

Try to stay blame-free and focus on the problem at hand.

I'd start with the risks:

• Risk to people - exposure of the HR/financial data linked to individuals - can violate laws, cause harm and result in fiscally damaging lawsuits.

• Risk to company reputation - both your company and the provider of the service.

• Risk to users - of being accused of inappropriate data access

Have an estimate on likeliness of risk, level of impact, etc.

Then start following up with concerned parties, starting with your company.

You may also follow up with the data provider - if this hosting site is not internal to the company providing the HR/finance data, find the data provider's security organization and start talking the risks with them.

Chances are, if either company does not have a CSO or CISO, they have a CTO or a CFO - I'd honestly start with whatever the highest level of risk management is - a security risk is a business risk, and the people most likely to respond are those tasks with mitigating risks.

The trick is to sound sane, write well, speak convincingly and generally make the case that you are a smart, trustworthy person.

For job protection, I'd start internal, get approvals before going to outside groups, and keep my manager in the loop at all times.

If that didn't yield results, it's worth researching personal information protection laws in your country/region and verifying what the expectations of due diligence are, legally. This can get hairy, as the jurisdiction may be the state that hosts the service, the state of the people who's data is being violated, or something even broader. Blowing the whistle on inappropriate data handling is not where I'd start - I'd start internal and work outward - helping prevent loss, reputation damage and better security practices makes you a hero. Blowing the whistle may get you press coverage and it may save much data loss, but you won't be a universal hero, as the companies involved will almost certainly loose face, and they won't be so thrilled with that.

This comes strongly into the softer side of security - finding the key stakeholders who can actually affect organizational change, and getting them onboard. Knowing how to present the problem and ask questions to generate actual thinking is really important here. Walking in and telling them they have screwed up is unlikely to actually get you the results you want - you have to get them to convince themselves that there is a problem to be fixed here.

In all honesty, I couldn't even tell you if I would listen if you came to me... I'm just as happy in a public forum to NOT know exactly what data is at risk here, but it'll take a really serious dig into EXACTLY what information is private or public, specific or generalized before you can make the case.

Answer 2

Account for poor backend security

If they're storing your password in plaintext (which is more than reasonable to suspect) then there's really nothing you can do about that. But what you can do is limit the amount of exposure to yourself that a security breach would cause. To the extent that their poor security isn't your problem, you don't really have to care.

Exercise caution with what information you share with them; though to be honest you should already be in the habit of limiting your sharing of personal data with anyone. Anyone you deal with could get hacked, not just the ones who look like they have crappy security. Make sure their failures don't cause you grief.

Choose a decent, random, unique password

A 20-character password chosen from your limited character set of [A-Za-z0-9] is still approximately 120 bits of entropy, and well beyond reasonable brute-force limits. Password restrictions are generally a red-flag, but in this case you're not limited so much as to make secure passwords impossible. Still, the potential of a plain-text backend means don't re-use a password from somewhere else. Of course, you weren't going to do that anyway, right?

Choose good answers for the security questions

Which question you choose doesn't really matter because you're not going to actually be answering them, right? For example:

Q: What is your mother's maiden name?
A: 1a9457e11b9a879e1939ff8fcc3f6246b48a8fa8

The answer is the sha1sum of the question, which isn't a terribly good answer, but it's a hell of a lot better than "Smith". You can do better; get creative.

As a rule, never give correct answers to the security questions. But you knew that already, right?

In the end, accounting for poor security just entails following the exact same rules you should be following already.

Answer 3

As to securing myself to extent possible, here are the steps I've taken thus far:

1. A user name that's long and pseudo randomly generated.
2. A password that's long (given the constraints) and pseudo randomly generated.
   • Will be changed ~weekly.
3. Unguessable answers to the security questions, along the lines of:
   • 
   • Don't worry, those aren't the actual values. Turns out the security answers can't have special characters in them either. (Just... so much facepalm.)
4. Linked to an email account which does have two factor auth.
5. Instructions to limit, as much as possible, the sensitivity and amount of information we actually use this turd for.
6. Prayer. Lots of prayer. As well burnt offerings and blood sacrifices to $[diety].

Answer 4

I don't think this is too difficult, if you must use the site then use a random combination of upper case and lower case letters and numbers for the username, password and secret answers 1-4.

As for what you can do - contact the company in question pointing out the flaws in their login system and suggesting improvements, if they ignore you at least you tried.

You haven't told us your relationship with this company but if your employer is using them then contact your employer's security department with the same information. If you can get them to get in touch they are probably more likely to listen to the people paying for their product.

Answer 5

My suggestion: take a step back for a moment. Don't get too blown up over it. If you have to use the site, here are a few simple steps you can take to protect your own security:

• Choose a strong password. Choose a random 12-character password (complying with their guidelines). If you do that, I can pretty guarantee you that the entropy in your password will not be the weakest link in the system, and it's very unlikely anyone will be able to get into your account by guessing your password.

• Choose fake answers to security questions. Nobody ever said you had to give the correct answer to those security questions! Choose a random 16-character string, and use that as the answer to the security question. Write it down or print it out, and store it somewhere safe.

• Sign up with a private email address. If you're really concerned, create a private email address that is different from your public account, and register your account with that one, rather than the one that everyone can guess. (But this is probably overkill, and I probably wouldn't bother.)

That's not so hard. Do that, and you're done.

OK, the site may have made some questionable security decisions. Granted, it's annoying. But still, I don't think it's worth it to invest too much of your emotional energy into this. Stuff like this happens. Protect yourself (as suggested above), move on, and get on with the rest of your life. Watch a good movie, talk a walk in the park, enjoy sunsets. Life is good, don't let dumb security stuff get you down!