Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change your bank. But it might not be as practical if company X is your university/college/school or government.

Let's say you are not willing/able to change to another service provider, and you don't want them to be sharing your information with the rest of the world. What do you do? It's hard to call the company and tell it that it needs to do a full pen test. They have a tendency of getting defensive in a situation like this.

So my question is how do you tell/prove to a company that its security is weak and they need to do something about it to stay within the bounds of the law? (I think this mostly applies to larger company/organizations so please focus your answers towards them.)

After all impersonation and most on line security testing is illegal. After all if your name is robert') DROP TABLE students;-- then it's just a question of time until you accidentally find something. :)

How do you address social engineering and/or software weakness/concerns in a company or organisation?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

I agree that breaking in is a bad idea.

Also - you might consider that while you are a customer of the organization, going public is also of limited value, since any break-ins that occur are likely to damage you, as well.

I agree that your immediate best bet is to withdraw your affiliation and find a company with better security practices... but I'm staying within the confines of the question and assuming this isn't an option.

A good practice is to hunt down the right person and tell them about your concern. The right person in a big organization can be very hard to find, since it is most likely NOT the guy answering the phone at customer support. Options include:

  • trace through customer support management chains until you find someone with a serious enough title that he might take you seriously
  • research the company's executive management - in a big enough company, there should be a Chief Security Officer or similar title who has equal power to the person in charge of IT. Often these people don't have easy to find contact information published publicly, but you might try a formal letter as a concerned customer. Just be careful of your wording that this is a request for assistance, not a threat.
  • if you honestly can't through to the company, there are often government agencies that cover specific areas of law - it varies from industry to industry. And things like the Better Business Bureau.
  • if the issue is truly egregious (and illegal), and the company is big enough, you could retain legal counsel and bring a class action lawsuit.

Most of these are going to take serious time. You'll likely fail on the first few attempts to get help. This can be a major struggle. But if it's your data, and you don't have another option to find a better resource, this kind of battle may be the right option.

YMMV - my experience is centered in the U.S. Can't say that other governments offer the same set of protections.

share|improve this answer

For social engineering, it is pretty difficult, but still you can ask that any communication with you should be (for instance) via email should be using PGP or using a specific pass code for phone calls.

Now regarding technical stuff, it is fairly easy where you actually are a customer and have the product at your site. In such a case, yes you ask to assess your product via a security consultant. The issues you find you report them back saying you need them fixed as they were identified.

Now regarding On the cloud solutions, like University accounts, online banking,... you need to contact the secure@bank/univ.com and ask them to fix it within a certain time. You politely inform them, that in case of no reply, you would be obliged to contact the press (you need not to do that, just threaten). For sure you will get a reply but that does not mean positive reply but an assessment on whether they would fix it or not. After that it is a case by case.

share|improve this answer
    
Threatening to contact the press is a pretty good way to ensure you're ignored, particularly if you impose an arbitrary deadline; at best, it means your threat will be routed to a PR group, rather than someone that can fix the problem. –  caelyx Apr 29 '11 at 6:10
1  
:) OK, as you wish! You know you can run after the CSO or you enter through the Product Security Response secure@company/universirt.com entry point of every security researcher. There you respect the responsible disclosure by giving them a timeline and then you have rights so you do not allow them to investigate your vulnerability for ever but you tell them after 3months I WILL GO PUBLIC and well that always work! check the CVEs that don't have patches... –  Phoenician-Eagle Apr 29 '11 at 14:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.