Timeline for How can I convince my boss that storing third party passwords in plaintext is a bad idea?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 27, 2018 at 12:27 | comment | added | emory | I think if you want to make a business case, then you would have to give an estimate of the size market that would simply refuse to give you their credentials (eg., me). OP's company is simply throwing away the segment of the market that are not security morons. This, however, would require completely reworking the process. | |
| Feb 27, 2018 at 12:24 | comment | added | emory | If there is a breach, OP's boss will in this order (1) not know about it, (2) minimize its impact, (3) buy credit monitoring, (4) declare bankruptcy. There is a 90% chance that it will not get past stage 1. It is extremely unlikely to go past stage 2. In the worst case, stage 4, the principals will not be materially affected. | |
| Feb 26, 2018 at 19:34 | comment | added | Tom | Second, the "nothing bad happened so far" isa common fallacy. It's the exact thought that people had in Tchernobyl the day before it exploded. If something is expected to happen every 5 years, and you had 5 years without it, it is time to get nervous because you are overdue. The proper answer, however, is that you can use this data to revise your estimate. | |
| Feb 26, 2018 at 19:32 | comment | added | Tom | An estimate of the probability is an absolute necessity to estimate the risk. Of course it is an estimate, but you should be able to at least give a range. If it helps you can inverse it and state not % per year but MTBF - every how many years do you expect this to happen? | |
| Feb 26, 2018 at 12:58 | comment | added | Serge Ballesta | It is easy to explain that there is a risk, that consequences could be serious, and that this risk could be easily mitigated. But giving a precise evaluation (10% per year) is much more difficult. The answer could be: we have been doing that for 5 years and still no problem, so your evaluation does not make sense. | |
| Feb 26, 2018 at 8:01 | history | answered | Tom | CC BY-SA 3.0 |