I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. Raising concerns with management was met with "too much time/money/resource" unless the security issue in question was exploited and, in those cases, was met with "why didn't you fix that!?".
Over time employees/contractors end up not mentioning security issues due to the responses from management and these security concerns are left behind. Of course this doesn't happen everywhere but certainly the majority. The flip side to this is management/decision makers who are paranoid about security and spend millions on worthless stuff because it says "secure" on the box/in the name.
My question therefore is this- is it ethically correct to ignore a security issue because a boss/ client has told you not to fix it due of time/money concerns? Is it ethically correct TO fix it after an express order not to fix it.
Part of the biggest problems I've experienced in spotting security issues isn't always the response but more the time taken during the decision making process. During that time we could be leaking a lot of data or even worse - a lot of user data that's almost always sensitive.
Sort of a side note but how on earth can we train staff, decision makers and users (yes there's a difference!) that these issues exist and should be fixed but without them jumping too far in the deep end.
Edit Just to clarify - this isn't about going against management decisions or not realising you're creating a bigger security issue than what was previously there. I'm talking about a definite security flaw that you've spotted, can fix and don't have client authorisation.