4

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (seem) to care and the customers have no idea. A few of the problems are:

  • Printed passwords, name and addresses of customers
  • Not destroying these documents
  • Same password for most systems
  • etc. etc.

Now I pointed out these points are a serious problem and can cause major damage to both customer and reputation damage to the company. However they don't take me serious since I am just the nerdy IT security student. What is the best way to approach them and convince them that this is unacceptable? I stubbornly keep shredding all the documents hoping more will follow, no luck so far.

Even though it does seem alot like this post I do not think it is the same. However feel free to mark it as a duplicate if im mistaken.

|improve this question
  • Could you make a bit clearer in what ways your question is different from the one you linked? – Arminius Apr 4 '18 at 12:04
  • For me the biggest part is the privacy of data from customers, not really the security of IT systems specific. I believe these will be answered differently than the purely technical question that I linked. Feel free to tell me Im wrong :) – toom Apr 4 '18 at 12:06
  • 2
    Mention ISO27001 certification and how compliance will benefit the company... financially (the only way to make bosses understand) and how big the impact could be if a security breach arises... again financially. – Stephen King Apr 4 '18 at 12:13
  • 4
    Maybe you could try pointing out to them the GDPR maximum penalties for breaches, which are "Up to €20 million, or 4% annual global turnover – whichever is higher", and ask them whether that sounds like something that would be good for the company. Do they have a spare €20m lying around to cover this? – Sean Burton Apr 4 '18 at 12:25
  • 2
    If your company is located in Europe, they are obligated by law to report certain details about the health of the company to their homestate and/or the European Union. If they are publicly traded it is very easy to find out. If you are located in the US, it's a bit harder, but there are sites like owler.com that estimate business data. If nothing of the above applies, you can estimate yourself by number of employees, shininess of CEO office and car, height of office building and the like. Googling always helps. – Tom K. Apr 4 '18 at 13:04
3

if your compagny is working in Europe, tell him that in May, the GDPR will be launched and every company which have a leak of personnal data can suffer law pursuit and penalties around 4% of the world incomes.

More specifically, being a little structure was pretty safe years ago. But today, most of the hackers are targeting small structures (because they are not secure) to launch ransomware or to do bitcoin mining (which can cause your servers to be dead quickly and your electricity invoice to be scary).

most of the time, during a governance audit, I ask:

  • What is so sensitive that you cannot loose it?
  • The emails
  • ... no, not the emails, if you loose the exchange server is disturbing but your company still exist
  • hummm
  • what if you loose your ERP?
  • loosing the ERP ?
  • Everything, the invoice, the contacts, etc. Imagine someone breaks this server
  • ho no don't do that, without ERP we don't know who must pay us, what we have to deliver, it's critical
  • yes it is. Okay so you have the impact. What is the likelihood ? The ERP is not quite secure because the password is bad, so if someone try to break it, he will suceed
  • yes but noone will attack us
  • this is the last point: the occurence. How often someone will want to disturb you (evil employee, former trainee, hacker)? Can you really say never ? I don't think so, never does not exist. One time every 7 years ? Okay it's not often...but when it will come, you loose your entire company. How much your company is valued ? 1 000 000 ? Okay so your security yearly budget is 1000000/7: 140k
|improve this answer
  • 2
    If you make bold claims, please support them with sources or tell us why you are an authority in this field (and provide sources). – Tom K. Apr 4 '18 at 12:50
  • 1
    If you want people to co-operate with your point of view you don't hold a gun to there head. – li x Apr 4 '18 at 13:52
3

An approach I might take is to passively tell "the boss" that since you are studying the subject, you are going to research it a little more and that you'll send him some information based on what you find, while reiterating his or her current stance on the subject of information security. A lot of times, you have to sell your position in business/employment/etc, and a good way to do this as a very junior person in any organization is to position your stance in a way that makes "the boss" feel like they are helping you (by allowing you to research/advance your studies/etc)

This gives you a way to articulate your thoughts very well in writing and cite some very credible sources, IE expert social proof.

I would probably start with this site:

https://www.ftc.gov/tips-advice/business-center/guidance/protecting-personal-information-guide-business

I'd venture a guess that the whole "ftc.gov" domain thing will catch his or her attention. From there, expound on some of the principles that would apply to your business (maybe the Gramm–Leach–Bliley act if you offer financial services, specifically the Safeguards rule?)

And include "I shred documents because of this guideline":

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

which is released by the NIST, which is part of the Department of Commerce (links if you want)

...

Something to keep in mind is that once you present enough information, you'll likely be the most qualified person there to fix all of these problems; be prepared to do so.

|improve this answer
1

Unfortunately small companies do not take security seriously. I worked in a small company and when I mentioned doing security, my boss's response was "Don't be so focused. This isn't a bank!"

As a worker, the only thing you can do is raise awareness. It's up to management to determine whether to accept the risk or reject it. What you will need to do is to demonstrate the cost of security against the benefits that will be received from it. That's how management sees the world - what's the cost/benefit ratio? is it worth assuming the risk?

I'd start with facts. Find out some recent privacy breaches and what that has cost the company in question. Then compare what happened, how it could have been prevented, and what that cost the company in terms of what your company is currently doing. Make sure that management sees in clear black and white terms "This company did what we are doing. It cost them 500,000 quatloons. For a cost of 500 quatloons, we can prevent that from happening." That shows the risk and the cost, and now you're talking a language management identifies with.

In the end, it's up to management to take this seriously. We as technical professionals know the right technical approach to take; now we need to educate management on the right services and processes to ensure that business continues.

|improve this answer
  • The OP is an IT security student at the firm. It is very unlikely, that he/she has access to data that allows for a meaningful cost-benefit-analysis or to communication channels towards the management itself. – Tom K. Apr 4 '18 at 18:37
  • @tomK Such as Google? Breaches are regularly reported along with estimated cost to the business. Many comments above talk about GDPR - that info is also widely available. I'd also submit that OP has access to their direct manager. Once they've had that discussion with their manager, they've made management aware and now it's up to their manager to either accept the risk or determine where up the management chain this needs to go. – baldPrussian Apr 4 '18 at 18:50
  • Google does not tell you what infrastructure a company uses. If the company the OP works at, is at least a little bit complex he/she probably won't even know the full extent of their own infrastructure. You speak of estimating cost. Hey OP, quick, give me an estimation of much it would cost, to establish a PKI in your company. That's still complicated for an expert who knows all the details, it's impossible for someone who knows very little about the company he/she works at. – Tom K. Apr 4 '18 at 19:50
  • If a student came to me with what you are proposing, which is basically: I read this article from 2013 about this breach and our firm is kind of the same size as the affected firm. It cost them 100,000€! You don't want this to happen to us, do you? Btw: I know nothing about their infrastructure, they have kind of the same business model and they are from Italy! I would say: "very interesting, now focus on your tasks". #GDPR: A meaningful cost-benefit-analysis consists not of: "0.04 * global annual revenue = X" equals cost, "not having to pay it" equals benefit. – Tom K. Apr 4 '18 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.