Do you know how could I make my security complaints/advices more effective? Or How could I convince my boss about IT security?
There are a couple of known good practices in the field of IT security. My boss seems oblivious to all of them.
Now I am working in a medical platform with real data about patients, prescriptions and it offers functionality to prescribe medicaments and so on. I do not have a vast knowledge in laws about protection of data, but I think that medical conditions are one of the most sensitive.
I have been working in this project just for 2 weeks but these are some of the things I found:
On my thrid day I found a SQL injection that allow you to log in as a doctor (real doctor). When I informed my boss, he told me that it was fine, that they were going to change the login soon. In other words, the injection is still there.
We store the password in plain text. When I complained he said that the medical collective are really special and they would be lost if when they hit "recover password" a new one is created instead of giving them the old password.
At least we store the (other) sensitive data encrypted, like medical history, I think they are obliged by law.
And it is only my 2nd week. It is discouraging to see how my advices fall on deaf ears... But I think it is my duty to notify the vulnerabilities I find.