dealing with small businesses and security issues

Question

I am dealing with a small business that I have no choice right now but to deal with. I do not work for this business but my personal life dictates that I use them right now. I noticed a few months ago that they have a wireless network setup with WEP encryption (and a really weak key...don't ask), no MAC filter and the admin port is open (HTTP as well).

I brought it to the attention of the person in charge and explained to her that they needed to change their setup. I was told they outsource their IT to another local company (most likely just another guy that lives around here).

I wrote a note with a few suggestions to make it more secure, about as good as you can get on the $60 Linksys router they are using.

I noticed the other day (a few months later now) that it still hadn't been changed. I asked her about it and she said that the IT guy said that everything is fine the way it is setup.

I explained to her again that it was not fine.

Now, this place doesn't have my credit card or anything like that on file, but they do have all the personal information of me and my family and other families.

Any suggestions on how to deal with this? Other than to find another business which just isn't possible right now.

Answer 1

No matter what size the business, in my experience the only three ways to get a provider to move on this are:

• Financial: Tell them you'll take your business elsewhere - I understand this isn't possible here.
• Regulatory: If they are dealing with personal information they must provide appropriate protection in most jurisdictions (eg DPA in the UK - so the threat of a review by the ICO might work)
• Reputational: this isn't meeting what most would class as good practice. You wouldn't want to recommend them to your friends and contacts would you? A threat of disclosure makes it a financial incentive for them - they risk losing business.

For now get them to agree in writing that they take full responsibility for your personal data being hacked/copied/tampered through substandard wireless controls :-)

Answer 2

Have pity on the business and find out who their IT person is. Then go the "responsible disclosure" route. Tell the IT person you'll disclose their lax practices publicly (probably without disclosing the business itself) if they don't fix it soon.