Convincing the boss about the importance of privacy and security

Question

I work for a company that does not value privacy and IT security the same way that I do. It's a relative small company that is used to work this way without anyone complaining. The employees don't (seem) to care and the customers have no idea. A few of the problems are:

• Printed passwords, name and addresses of customers
• Not destroying these documents
• Same password for most systems
• etc. etc.

Now I pointed out these points are a serious problem and can cause major damage to both customer and reputation damage to the company. However they don't take me serious since I am just the nerdy IT security student. What is the best way to approach them and convince them that this is unacceptable? I stubbornly keep shredding all the documents hoping more will follow, no luck so far.

Even though it does seem alot like this post I do not think it is the same. However feel free to mark it as a duplicate if im mistaken.

Answer 1

if your compagny is working in Europe, tell him that in May, the GDPR will be launched and every company which have a leak of personnal data can suffer law pursuit and penalties around 4% of the world incomes.

More specifically, being a little structure was pretty safe years ago. But today, most of the hackers are targeting small structures (because they are not secure) to launch ransomware or to do bitcoin mining (which can cause your servers to be dead quickly and your electricity invoice to be scary).

most of the time, during a governance audit, I ask:

• What is so sensitive that you cannot loose it?
• The emails
• ... no, not the emails, if you loose the exchange server is disturbing but your company still exist
• hummm
• what if you loose your ERP?
• loosing the ERP ?
• Everything, the invoice, the contacts, etc. Imagine someone breaks this server
• ho no don't do that, without ERP we don't know who must pay us, what we have to deliver, it's critical
• yes it is. Okay so you have the impact. What is the likelihood ? The ERP is not quite secure because the password is bad, so if someone try to break it, he will suceed
• yes but noone will attack us
• this is the last point: the occurence. How often someone will want to disturb you (evil employee, former trainee, hacker)? Can you really say never ? I don't think so, never does not exist. One time every 7 years ? Okay it's not often...but when it will come, you loose your entire company. How much your company is valued ? 1 000 000 ? Okay so your security yearly budget is 1000000/7: 140k

Answer 2

An approach I might take is to passively tell "the boss" that since you are studying the subject, you are going to research it a little more and that you'll send him some information based on what you find, while reiterating his or her current stance on the subject of information security. A lot of times, you have to sell your position in business/employment/etc, and a good way to do this as a very junior person in any organization is to position your stance in a way that makes "the boss" feel like they are helping you (by allowing you to research/advance your studies/etc)

This gives you a way to articulate your thoughts very well in writing and cite some very credible sources, IE expert social proof.

I would probably start with this site:

https://www.ftc.gov/tips-advice/business-center/guidance/protecting-personal-information-guide-business

I'd venture a guess that the whole "ftc.gov" domain thing will catch his or her attention. From there, expound on some of the principles that would apply to your business (maybe the Gramm–Leach–Bliley act if you offer financial services, specifically the Safeguards rule?)

And include "I shred documents because of this guideline":

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

which is released by the NIST, which is part of the Department of Commerce (links if you want)

...

Something to keep in mind is that once you present enough information, you'll likely be the most qualified person there to fix all of these problems; be prepared to do so.

Answer 3

Unfortunately small companies do not take security seriously. I worked in a small company and when I mentioned doing security, my boss's response was "Don't be so focused. This isn't a bank!"

As a worker, the only thing you can do is raise awareness. It's up to management to determine whether to accept the risk or reject it. What you will need to do is to demonstrate the cost of security against the benefits that will be received from it. That's how management sees the world - what's the cost/benefit ratio? is it worth assuming the risk?

I'd start with facts. Find out some recent privacy breaches and what that has cost the company in question. Then compare what happened, how it could have been prevented, and what that cost the company in terms of what your company is currently doing. Make sure that management sees in clear black and white terms "This company did what we are doing. It cost them 500,000 quatloons. For a cost of 500 quatloons, we can prevent that from happening." That shows the risk and the cost, and now you're talking a language management identifies with.

In the end, it's up to management to take this seriously. We as technical professionals know the right technical approach to take; now we need to educate management on the right services and processes to ensure that business continues.