Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?

There are a couple of known good practices in the field of IT security. My boss seems oblivious to all of them.

Now I am working in a medical platform with real data about patients, prescriptions and it offers functionality to prescribe medicaments and so on. I do not have a vast knowledge in laws about protection of data, but I think that medical conditions are one of the most sensitive.

I have been working in this project just for 2 weeks but these are some of the things I found:

On my thrid day I found a SQL injection that allow you to log in as a doctor (real doctor). When I informed my boss, he told me that it was fine, that they were going to change the login soon. In other words, the injection is still there.

We store the password in plain text. When I complained he said that the medical collective are really special and they would be lost if when they hit "recover password" a new one is created instead of giving them the old password.

At least we store the (other) sensitive data encrypted, like medical history, I think they are obliged by law.

And it is only my 2nd week. It is discouraging to see how my advices fall on deaf ears... But I think it is my duty to notify the vulnerabilities I find.

  • 2
    I will be honest. The fact the password is stored in plaintext means that anyone with access to the plain text can decrypt the encrypted information, I assume the user's password handles the encryption, otherwise what good is it. You need to do research on what the laws are, what should and should not be gone, the present your findings to your boss. If you are given the cold shoulder then my suggestion would be to find another job because the company IS VERY LIKELY BREAKING LAWS dealing with medical information. It sounds like the company has NO business being in the field.
    – Ramhound
    Aug 16, 2012 at 11:58
  • +1, known problem. Actually one SQL vulnerability and plain passwords is relatively secure compared to other stuff I've seen...
    – Luc
    Aug 16, 2012 at 12:53
  • @Ramhound Isn't it possible that OP is also obliged by law to become a "whistleblower" and alert the proper authorities about improper treatment of sensitive data? Jun 27, 2013 at 7:07
  • @user1049697 - Unlikely. He was only on the job two weeks and he didn't mention he was obligated to do anything.
    – Ramhound
    Jun 27, 2013 at 11:34

4 Answers 4


There's several issues here.

Your immediate concern seems to be that you have not managed to convince one individual of the need for better security. Fixing that will solve the problem - but it may be a big mountain to climb. Greg Dolph's answer already covers this.

The problem here is that your employer is producing a product which is not fit for purpose, and may result in serious damage to your employer, to the users of the product, and to other parties. Unless the organisation which employs you is your boss (and does not have other stake holders / share holders), then you should at least be making other key decisions makers aware that you have concerns which your boss thinks are unfounded.

It's commendable that you are concerned with the security of the systems you are working on, and you have taken the first step to resolving the problem. But if this does become more widely known, then it's likely that those responsible for decision making (or possibly even those responsible for enforcing law/policy) will want to be seen to be taking action - i.e. you need to cover your rear. Try to make sure you've got any verbal discussions noted, preferably minuted. Get copies of all emails somewhere you can access them.

Don't threaten. Don't cajole. Keep calm. Be persistent. Keep records.

  • I would even suggest that the time for discussion is over. Contact everyone whom has a part in this, make those players aware of the situation, keep records of what you did to solve it though.
    – Ramhound
    Aug 16, 2012 at 13:27
  • @Ramhound Not true, and a dangerous suggestion. After 2 weeks, he does not have enough knowledge of all the factors. Pounding the table and insisting he is right will end up not making any changes.
    – schroeder
    Aug 16, 2012 at 14:40
  • +1 for keeping good records documenting your involvement and warnings.
    – Grant
    Aug 16, 2012 at 17:08
  • I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible" Do you think is a good aporach telling this to my boss by email?
    – eversor
    Aug 17, 2012 at 16:40
  • @eversor: no, I don't think that, on it's own, is good advice. Have a look at published standards such as PCI-DSS, NIST, OWASP, SANS, HIPAA....
    – symcbean
    Aug 20, 2012 at 10:26

The best way to go is to point your boss to the laws, industry regulations, and real world cases where companies have lost their shirts and executives walked out the door or sent to prison for breaking them. Nothing motivates execs like personal risk. Make it apply to them, not just to the company. You can talk about best practices and industry standards, or even how audits require these things, but they may not care unless you show that by not caring things could get real ugly for them.


My recommendation is to show your boss what implications this may have for his business. Especially emphasize the fact that if you got attacked and information gets disclosed (you can provide him with examples of other companies that got hacked like Linkedin or Yahoo) the reputation of his company is at stake.

Especially when dealing with sensitive medical data. Also do remind him he (yes he personally) can be held liable for a breach if he was informed that he did not do enough to protect the system. (You could also say because he was informed before hand that there was a breach, but that might be considered too much of a threat).

Like symcbean says, do not threaten and keep records.


Storing passwords in plaintext is in violation of the spirit of HIPAA law and possibly the text.

This document on best practices for HIPAA password management states:

H. Application developers must ensure their programs contain the following security precautions:

  1. Should support authentication of individual users, not groups.
  2. Should not store passwords in clear text or in any easily reversible form.
  3. Should provide for some sort of role management, such that one user can take over the functions of another without having to know the other’s password.
  4. Should support TACACS+, RADIUS and/or X.509 with LDAP security retrieval, wherever possible.

However, the actual text of HIPAA law doesn't get into technical details. It doesn't talk much about password management (other than saying it should be addressed) but does state in 164.306(a) (General Requirements of Security standards)

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.

This is a reasonably anticipated threat that is easily mitigated.

If compliance with the law doesn't work and you are a vendor selling a product, note that this "feature" is causing you to lose sales. Many hospitals (I work at one) have high-ups in IT/informatics departments with reasonable IT backgrounds and during product review phases will test how password resets work, and will veto products and avoid that vendor in the future if we find out it sends back plaintext passwords.

  • (I am from Spain) I found an article of a law which says (Translation from Spanish): "[...] while it(password) is still being valid, it must be stored unintelligible"
    – eversor
    Aug 17, 2012 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .