How to convince your boss about importance of IT security

Question

Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?

There are a couple of known good practices in the field of IT security. My boss seems oblivious to all of them.

Now I am working in a medical platform with real data about patients, prescriptions and it offers functionality to prescribe medicaments and so on. I do not have a vast knowledge in laws about protection of data, but I think that medical conditions are one of the most sensitive.

I have been working in this project just for 2 weeks but these are some of the things I found:

On my thrid day I found a SQL injection that allow you to log in as a doctor (real doctor). When I informed my boss, he told me that it was fine, that they were going to change the login soon. In other words, the injection is still there.

We store the password in plain text. When I complained he said that the medical collective are really special and they would be lost if when they hit "recover password" a new one is created instead of giving them the old password.

At least we store the (other) sensitive data encrypted, like medical history, I think they are obliged by law.

And it is only my 2nd week. It is discouraging to see how my advices fall on deaf ears... But I think it is my duty to notify the vulnerabilities I find.

Answer 1

There's several issues here.

Your immediate concern seems to be that you have not managed to convince one individual of the need for better security. Fixing that will solve the problem - but it may be a big mountain to climb. Greg Dolph's answer already covers this.

The problem here is that your employer is producing a product which is not fit for purpose, and may result in serious damage to your employer, to the users of the product, and to other parties. Unless the organisation which employs you is your boss (and does not have other stake holders / share holders), then you should at least be making other key decisions makers aware that you have concerns which your boss thinks are unfounded.

It's commendable that you are concerned with the security of the systems you are working on, and you have taken the first step to resolving the problem. But if this does become more widely known, then it's likely that those responsible for decision making (or possibly even those responsible for enforcing law/policy) will want to be seen to be taking action - i.e. you need to cover your rear. Try to make sure you've got any verbal discussions noted, preferably minuted. Get copies of all emails somewhere you can access them.

Don't threaten. Don't cajole. Keep calm. Be persistent. Keep records.

Answer 2

The best way to go is to point your boss to the laws, industry regulations, and real world cases where companies have lost their shirts and executives walked out the door or sent to prison for breaking them. Nothing motivates execs like personal risk. Make it apply to them, not just to the company. You can talk about best practices and industry standards, or even how audits require these things, but they may not care unless you show that by not caring things could get real ugly for them.

Answer 3

My recommendation is to show your boss what implications this may have for his business. Especially emphasize the fact that if you got attacked and information gets disclosed (you can provide him with examples of other companies that got hacked like Linkedin or Yahoo) the reputation of his company is at stake.

Especially when dealing with sensitive medical data. Also do remind him he (yes he personally) can be held liable for a breach if he was informed that he did not do enough to protect the system. (You could also say because he was informed before hand that there was a breach, but that might be considered too much of a threat).

Like symcbean says, do not threaten and keep records.

Answer 4

Storing passwords in plaintext is in violation of the spirit of HIPAA law and possibly the text.

This document on best practices for HIPAA password management states:

H. Application developers must ensure their programs contain the following security precautions:

1. Should support authentication of individual users, not groups.
2. Should not store passwords in clear text or in any easily reversible form.
3. Should provide for some sort of role management, such that one user can take over the functions of another without having to know the other’s password.
4. Should support TACACS+, RADIUS and/or X.509 with LDAP security retrieval, wherever possible.

However, the actual text of HIPAA law doesn't get into technical details. It doesn't talk much about password management (other than saying it should be addressed) but does state in 164.306(a) (General Requirements of Security standards)

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.

This is a reasonably anticipated threat that is easily mitigated.

If compliance with the law doesn't work and you are a vendor selling a product, note that this "feature" is causing you to lose sales. Many hospitals (I work at one) have high-ups in IT/informatics departments with reasonable IT backgrounds and during product review phases will test how password resets work, and will veto products and avoid that vendor in the future if we find out it sends back plaintext passwords.