Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a company has terrible security policies like letting people email password in cleartext emails, what to do if they reject all fair minded advice?

share|improve this question

2 Answers 2

Ridiculing them in a public fashion isn't necessarily the best approach.

What can be done to help people who do inadvisable things but refuse fair minded advice?

Nothing.

You can show them the risks of what they are doing. You can calculate the cost of breaches because of these risks. You also have to compare them to the liklihood of a breach actually occurring. If they do nothing when you say it's going to cost $10,000 to recover from a breach that has a 67% chance of happening in the next six months, but it's only going to cost $2000 now to prevent it, there is really nothing you can do about it.

After a breach occurs they'll probably come back to you and ask to reevaluate their options, but that's an entirely different problem.

share|improve this answer
    
I know stats and predictions like that sound compelling and look good on paper, but I've rarely (if ever) seen them motivate companies. "Insurance isn't bought, it's sold." –  Steve Dispensa Sep 11 '11 at 23:51
    
Stats alone won't motivate a company, but they apply to the context of "fair minded advice". –  Steve Sep 12 '11 at 3:43

1) Find another company to do business with

2) Tweet about them to bring some public pressure to mend their ways

3) Use a totally random, completely unique password. You could use something like LastPass to generate one, although for what it's worth, you should bump the default length to 12 characters, not 8.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.