6

My question is related to this one. I did not found anything googling around and that is why I am asking.

This question

I am the sole web developer for a firm, and I manage everything, from installing cables to a very complicated web-app. The app contains sensitive information like sort codes, bank accounts, names, addresses, etc. I am continuing the old web-developer's work, and he stored everything in the database as a plain text.

I have not taken any steps to correct this because it would cause some down-time for the business and my boss didn't pay much attention to what was I saying. Now I'm starting to think that this information might become a target as soon as the word gets spread around. (The users whose information is being stored have access to their own info.)

The app is pretty big now and I am afraid that if anything bad happens I will be responsible for it. What should I do and what steps should I take?

Improve this question
1
  • We've all been there man, cleaning up other people's messes. You need to convince the boss your company is at risk for a lawsuit at best, and actually hurting a lot of people at worst. If he refuses to do what's right, then I would update my resume, because YOU are the one that those people are relying on to do the right thing, not your boss. SALTED HASH, my friend.
    – Chris B. Behrens
    Dec 18, 2012 at 16:37

1 Answer 1

Reset to default
8

You absolutely have a responsibility to maintain the confidentiality of financial records.

Depending on your country's laws and legal precedents (disclaimer: IANAL) it may be the case that you (as a company) could be prosecuted or sued for negligence in the case of a breach. I see that your profile says you're in the UK, so government organisations such as the ICO and FSA can get involved if a breach occurs and customers end up being defrauded because of it. They have a history of handing out hefty fines to companies who act irresponsibly with their customers' financial details. On top of this, individual customers can sue you separately, based on their individual losses.

Keep in mind that a breach that leaks a customer's personal information because of insufficient security measures automatically puts you in violation of the Data Protection Act 1988, which is something the ICO can prosecute you for.

In fact, your bank or card processor may require that you're PCI compliant in cases where you store financial credentials, so if that's the case then you may be in violation of the contract you have with them. In such a case they may revoke your services, fine you, or even sue you in court.

My advice is as follows:

  1. Look through your system and identify what information needs to be protected, and what the best method is to protect it. For passwords, you should be using a key-derivation algorithm such as PBKDF2 or bcrypt - not a hash like SHA1. For financial information such as account numbers and sort codes, you should be using a HSM, or at least symmetric encryption with an in-memory key. Can you outsource your credential storage and/or payment processing to a 3rd party provider? Build up a list of suggestions and expected development times, and prioritise them by severity. Be realistic - saying everything is critical will make your boss switch off.
  2. Go to your boss and explain that the current way your company is storing financial information is negligent and that your current security measures are insufficient. Explain why it's bad, what the appropriate legislation is around it (especially DPA 1998 and other ICO regulations) and the standards which most companies are expected to adhere to (PCI-DSS, ISO/IEC 27000, etc.). Make sure he fully recognizes the potential for severe financial (and potentially legal) penalties should you be breached.
  3. Get him to talk to an information security company that specialises in PCI-DSS or similar financial regulations. Often they'll give a free (or cheap) consultation to go over any concerns he has, and give him some advice. From there he can decide what the risks are. It may well be worth having a thorough penetration test done on your web-app, since it's storing financial details. This is an expense, but it's much cheaper than being sued.
  4. Take action based on the information you gain, and make sure you have the results vetted by a professional.

If, after all this, your boss still decides to ignore the serious security and privacy issues your web-app has, ask him to put in writing that you cannot and will not be held responsible for any legal issues related to data security breaches during your employment. If he refuses to do so, I highly recommend finding another job and reporting them to the ICO. It's not worth the potential legal problems.

Improve this answer
2
  • 1
    Thank you mate I belive that you are saving my !@$... Those ware my consirns ... Thank you again and I will make my way trough this, hopefuly everything is sorted soon.
    – DaGhostman Dimitrov
    Dec 18, 2012 at 12:23
  • 1
    @DaGhostmanDimitrov - If you do end having to leave make sure you somebody higher then your boss aware of the problem. This includes government watchdog groups that sort of thing.
    – Ramhound
    Dec 18, 2012 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .