As a security compliance professional, what should I do if I find that my employer has a PCI AOC but is not compliant?

Question

I have an ethical dilemma. A couple of weeks ago, I accepted a security compliance role. For the past five years I have been working as a PCI QSA before accepting this role.

In the short time that I have been with the company I have come to learn that they should have never been able to acquire their PCI AOC. As the company is not compliant with numerous requirements from multiple categories within the PCI DSS. As a formal PCI QSA I would not have gave them a passing AOC.

I have expressed my concerns with executive management and was simply told well we have it. Yes, they are aware of the shortcomings. Other members of management and the security team have pulled me aside and explained that one certain member of executive management are dear friends with an executive of the QSAC and that is why they were able to get the PCI AOC.

The members of the Security Team agree that they should not have been granted the PCI AOC based on the evidence they provided or lack of evidence. But that I am the third person in this role and to very careful what I say to one certain member of the executive staff even though it is my job to identify and remediate such things. I want this job and I think the company is a good company, the problem appears to be this one executive staff member.

When I was a PCI QSA this decision was simple as I had an ethical obligation to report such infractions to the PCI Council. But now my situation is different, yet I still believe that I have an ethical obligation as a Security Professional.

I don't feel that I should have to choose between doing what is right and keeping my job.

Answer 1

IMHO, the most ethical think to do would be to resign and report them. The reasoning:

• You have an ethical obligation to the users to keep their data safe to the extent the company claims you do.
• You have an ethical obligation to your company to keep their products working, secure, compliant and to follow orders.

Because you can't uphold both, you should resign, as that would free you of the second obligation and because the company is putting you into this position.

More practically:

• You may want to talk with the other execs, explaining that knowingly being not compliant and misleading customers opens the company up to a lawsuit for damages and also that if it was revealed, they could loose consumer confidence especially considering current situation with privacy and security having the public's attention. The possible danger to the company ought to get you their attention.
• You may want to consider gathering evidence and letting the mentioned exec fire you, then file a lawsuit for wrongful termination or the other thingy, hindering your career (not a lawyer, consult real lawyer). The result would be the same as in the ethical example, but you would get some money four your trouble.

Answer 2

Personally, I would investigate two possible avenues:

1. Internal Audit - many people are scared of IA and managers don't like them sniffing around as they tend to spot issues that need dealing with. However, in my experience, going to them directly (and making your situation clear) can be very effective.

2. If your organisation has a whistle-blowing policy, it would be sensible to quietly investigate it. I would consider that if IA didn't work.

In either case, you MUST make sure that you have documented evidence about the issues and evidence that you have raised the issue to the appropriate management. You must also make sure that, when you don't get a written response (typically you will only ever get verbal responses in these cases), you follow up by sending out another email saying that you've had no response. At that point, you are covered as you have done what is required by your role. Now, if you get pushed out or directly fired, you have a case to bring for wrongful dismissal. Of course, make sure you have copies of the relevant emails outside of your work computer. If you have a lawyer, forward the emails to them so they have the timestamp.

Having covered yourself, you now have the above options open to you. Of course, you have to recognise that following up on this may well result in you losing your job anyway. You need to be prepared for this.

Before embarking on any of this, you will want to double-check all of your assumptions. Make use of professional networks and perhaps consider joining a professional group who may be able to support you.

Answer 3

How many times have you done a follow along assessment where you wonder, “how the heck did they pass last year?” I can tell you I see this all the time as a QSA. Customers hate it when I tell them they have to something different, larger in scope, costs more money, and it takes longer. I always say, “I don’t know what happened last year, but I point the DSS and say this is what you have to do.

I often wonder if I should report the old QSA, but I come back to; “They used their judgment to pass the company, maybe there is something I don’t know.” As QSAs we use our judgment to make decisions all the time. You may have used yours to let a customer pass when they were not meeting requirements to the letter, but were going a good enough job and the risk was low.

I personally think your job is to just fix the issues and forget about the past – accident of history. If the QSA does this bad practice often enough they will get caught and they will loose their certification.

I would protect yourself by gathering the facts if management decides to take action against you, but your job now is to fix the issue at hand.

Now,

Go to the other members of the executive group and tell then you want to use a different auditor this year, not your old company! This way you avoid the issue of “friendly pass”. Don’t get into a blaming war about the past, you will loose.

Just say, “Look, it was an accident of history, I don’t care. You hired me to do a job. I need to use a different auditor to do the job correctly”. If they don’t support you, start looking for another job ASAP. If new company asks why – tell the truth without exposing the names. Just say my ethics don’t allow me to do something I know is wrong. I was being put into a position where I knew it was really wrong and it was a no win situation.

Given your experience, you know what has to get done to protect the company. Likely the execs are going to have a fit given the $, time, resources you need to get the job done right. Lay it out cold and if they refuse, start looking for a new job. Once you are out, send a letter to the board members letting them know they have an issue in the management; let them deal with the execs as a good board should be doing.

If you are the 3rd person in role, likely the folks before you tried and failed; they were shown the door or quit because it was untenable to them. Given that the current regime has shown to be less than competent you might just look for a new job now and avoid the *&^% storm you are about to start up. If you walk or get fired; you need to warn your team about the issues and possible blow back on their careers if something bad should happen to the company due to a breech.

The engineer in me says try to stick it out and fix the issue. If you succeed you have a great victory; management will respect you for doing a hard job; but that is what you signed up to do. The experienced manager in me says walk out now before you damage your carrier; there are lots of other good companies looking for folks like you.

I guess I will add this; if the violations are really flagrant; open ports, segmentation issues, patching issues; no PEN testing... - stuff that really put the company at risk then you should report the QSA. You did not spell out how bad the violations where; so use your judgement here. Be mindful that you don't know what happened last year or the years before.