I work in a company where security is a "fire once forget forever" concern. The administrator sets up a solution and seldom follow up and maintain it. As a result, we've got a security policy that's kind of Swiss-cheesed: full of holes.
- password security policies requiring changing every xx days with no backtracking, but accounts whose passwords are not changing handed to anyone to access special folders and database, even interns who then leave with the unchanging info
- desktop and network antivirus, but no policy against USB drives. So far most viruses are caught and the culprit scolded, but one time with a 0-day is enough...
I have the feeling that security is a cosmetic concern here; the management want to be seen doing something, but is not doing the right thing, or not everything that should be done.
I thought about gray-hatting to demonstrate the problems in a dramatic way, but I don't think it's the right way to educate people about security in this context (perhaps in a completely security-focused company where everyone gets the situation).
So I'm wondering about a good way to spin the need for a more resilient security strategy. I'm not in a position to point out blogs and direct experts advice, because management doesn't talk English.
I was thinking about doing either an elevator pitch with some dramatic claims or a ten minutes demo of existing problems.
What do you think about these ideas? Are there recommended ways to point out security flaws when auditing for a client so as not to alienate them by basically saying "that's an half-bottomed work you did"? Are there particularly effective demos (just launching a firesheep? but that borders on gray-hatting) you'd recommend?