3

I am in an "argument" with my company about them showing each and every employees social security and full banking routing / account number in plain text on a leading hosted HR Management software application. They have the ability to hide it, like every other application I have ever seen, but they refuse to for their convenience. They cite things like it is hosted in the same server farm as the CIA.

I am not too concerned with security in the backend systems, just the fact that they present the data to a user logging into the system in the front end of the application in plain text (though encrypted). I know it is bad practice to do this, but I can't get them to budge.

I believe that the application has 2 factor authentication set up for reports and more data vulnerable functions. The application does use RSA 2048 / sha256RSA.

I have brought up the Sony, White House, Anthem, and OPM hacks, but they still shrugged it off.

Does anyone have any suggestions on how to convince them to turn on masking of these fields (XXX-XX-1234)?

Are there any laws, lawsuits or other kinds of guidance that I could cite to help push the securing of this information (like PCI DSS compliance)?

I guess the real question should be: How do I elegantly explain this to "people who do not understand the actual risk"? (this was run by the "risk manager" as well)

Asked for legal ramifications here

  • 4
    @Limit True. On the other hand, PCI DSS compliance is on-topic here. – S.L. Barth Oct 26 '16 at 14:09
  • 1
    @Limit, not a legal question. It is meant to be an information security question. – Lucky Lindy Oct 26 '16 at 14:13
  • 4
    To be clear, you're describing your SSN and your bank account info being made available to you, your boss, and probably HR and financial departments? Not to unrelated parties like coworkers? (And this is not a PCI-DSS issue, there's no card data involved, bank accounts are not credit cards). – gowenfawr Oct 26 '16 at 14:19
  • 1
    PCI DSS is an industry standard that only governs payment cards, and is enforced only by contractual agreement between payment providers, payment processors, and merchants. PCI DSS is not the law, nor is it a watchdog with any enforcement ability. It does not govern SSNs or bank account numbers. However, there may be government departments who do investigate and enforce security standards in relation to SSNs and bank details; in the UK we have the Information Commissioner's Office (ICO) which enforces the Data Protection Act 1998 via imposed fines and restrictions. – Polynomial Oct 26 '16 at 14:37
  • 1
    @TopherBrink astonishingly, direct debit is not a credit card charge, and bank account numbers are not credit cards and not subject to PCI. These terms have actual, discrete meanings. – gowenfawr Oct 26 '16 at 14:39
4

There are 2 things here, them storing the data in a readable format and them showing you. They do need the data to be in a readable (by the program) format because it is needed to send people money and for tax reasons or to put on wage slips.

They should however not show you sensitive information that you don't need to see. If you wanted to you could use all that information for malicious activities. It is their responsibility to reduce the attack vectors without reducing functionality, giving you this info is making an unnecessary attack vector for little or no functionality.

The fact that the server farm is the same as the CIA means nothing. Its like saying that you live next to a police station so you wont get robbed. Additionally they should not know that they are in the same farm as the CIA because that now tells you one place the CIA have servers and that is info the CIA dont want anyone to know due to possible attacks against them. Lastly I wouldn't trust any government bodies with my data, most of the data breaches from whistle blowers are of data that the whistle blower should not have access to (Edward Snowden, Chelsea Manning, Harold Martin)

  • "They should however not show you sensitive information that you don't need to see" – Lucky Lindy Oct 26 '16 at 19:24
  • Thanks for clarifying. This is what I am trying to convince them of. I can't make a valid point other than it is not good practice. What specifically makes it "their responsibility to reduce the attack vectors"? I am looking for specific reasons and examples. Without these, I cannot convince them. "live next to a police station so you wont get robbed" :-) – Lucky Lindy Oct 26 '16 at 19:31
-1

If I understand your point correctly, you are worried with the fact that your information is presented to you when you log in?

If so this is a matter of arguably "bad practices" (except if there is a law which forces a service provider to hide personal data to the owner of the data). I just checked on amazon.com and my bank account: both show me a partial number - you could use such references.

There is however no systems / applicative security involved here: if the data is stored appropriately (= securely enough with the constraints of the intended usage) then the fact that one hides some information is to prevent its reuse by people other than the owner of the data (someone looking over your shoulder for instance).

Therefore your only way is to explain that the data presented in plain sight may be overlooked by someone else, with possible (though complicated to prove) implications for the service provider.

Unfortunately, the dialogue about "data stored in the same place as CIA" does not apply here, which means that this discussion is held between people who do not understand the actual risk (again, if I correctly got what you are asking).

  • I am not really concerned about my data, more of others in the large company that are not aware of safe computing practices. But yes, I am worried that the information is presented to me without masking. Yes: "people who do not understand the actual risk" – Lucky Lindy Oct 26 '16 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.