5

I have a fair number of security concerns with a client's operation and it made me think about all the security concerns I've observed and noticed throughout the years with different clients/jobs. Raising concerns with management was met with "too much time/money/resource" unless the security issue in question was exploited and, in those cases, was met with "why didn't you fix that!?".

Over time employees/contractors end up not mentioning security issues due to the responses from management and these security concerns are left behind. Of course this doesn't happen everywhere but certainly the majority. The flip side to this is management/decision makers who are paranoid about security and spend millions on worthless stuff because it says "secure" on the box/in the name.

My question therefore is this- is it ethically correct to ignore a security issue because a boss/ client has told you not to fix it due of time/money concerns? Is it ethically correct TO fix it after an express order not to fix it.

Part of the biggest problems I've experienced in spotting security issues isn't always the response but more the time taken during the decision making process. During that time we could be leaking a lot of data or even worse - a lot of user data that's almost always sensitive.

Sort of a side note but how on earth can we train staff, decision makers and users (yes there's a difference!) that these issues exist and should be fixed but without them jumping too far in the deep end.

Edit Just to clarify - this isn't about going against management decisions or not realising you're creating a bigger security issue than what was previously there. I'm talking about a definite security flaw that you've spotted, can fix and don't have client authorisation.

  • 1
    There's another option - fire the client on the grounds that you cannot be associated with a company that does not fix security flaws. That is the sort of professional integrity that preserves your reputation and helps your client understand the severity of the situation. – scuzzy-delta Apr 8 '14 at 22:03
  • See there's something more worrying in what you said, simply washing your hands and saying "not my problem" brings it's own security issues. It's a conundrum to be sure but I appreciate where you're coming from! – ScottMcGready Apr 8 '14 at 22:24
  • Ah, but that's not a fair representation of the scenario. As I understand it, you had previously taken ownership of the issue, but were prevented from fixing it. You are being assigned responsibility for an issue over which you have no authority, which is patently unfair. That's not comparable to neglecting your duties, which is implied by a "Not my problem" statement. – scuzzy-delta Apr 8 '14 at 22:34
  • It's a semi-theoretical issue that was brought about due to a particular set of circumstances (i.e. I was remembering some bad jobs where everything was broken down in excel into man-hours & $$$). However it's very interesting to see the amount of "not my problem"'s I receive when doing security audits. Front door unlocked? That's the janitorial team's job! My point is that sometimes I've got a "No" because the client/management doesn't understand why it's a problem or they don't understand the solution. – ScottMcGready Apr 9 '14 at 1:06
3

Every fix is a business decision. The business needs to make the call. You, as the one with the knowledge, need to properly inform and guide the business through the matrix of needs and costs. Optimally, there are policies and procedures in place to identify and incorporate fixes over time based on cost and priority, but unfortunately, not all do.

As for fixing a problem without oversight, what happens if you cause an even greater security problem? What if you expose the business to costs and damage as a result of unintended consequences? Oversight exists for a reason, to protect both you and the business.

As for ethical concerns, there is open debate of the ethics of information. In a situation where life and health are threatened, there are clearer and more defined ethical lines. Threats against information are more difficult to understand ethically. I have had discussions with some in the health care industry who have proposed the idea that a human's information is worth more even than a human's life (because it can effect the life and health of untold numbers of other humans).

Educate, inform, guide, encourage, and talk in terms that make sense to the business. These things you must do ethically and with passion.

2

One big problem about fixing something when being told not to do so is that you might be wrong in some point:

  • perhaps it's not a real bug / hole;

  • perhaps it is but some other layer of the application prevents it from leaking

  • perhaps it is a bug, it might lead to leaks, but your app isn't in the radar so it might not be discovered simply because nobody took a look at it

  • idem, idem, but won't cause all those harms you imagine

  • idem, idem, but you try to fix it despite being told to not do so, and increase the problem / bug

One thing is be faithful to your clients: every client wants the perfect product, and would love to know that there is someone inside every company that go against orders and fix the product anyway.

The other point is being faithful to who is paying your salary. They told you to not do so: make sure you have clearly stated the problem, the consequences, how it could be discovered, used by someone, how it could be fixed and how much (time/money/resources) it would take to fix it. Send it by email, register it somehow, and your job is done.

What your managers will decide is up to them.

  • The job isn't done though. Assuming that the issue is definitely there, fixable and won't cause another issue - some managers/clients won't want to fix it because they don't see it as a pressing issue until it's too late. Notifying them of the issue is fine but it still doesn't fix the problem. That's only true for the cases where there is a real issue and it's fixable without consequence. – ScottMcGready Apr 9 '14 at 1:24
1

The core question, is it ethically wrong to make a change that the boss / client etc. does not want, yet would increase security, the answer is quite simple.

Yes. It's wrong.

Let me ask the question in another way: How would you react if I went and made unauthorized (by you) changes to your tax return? The change, in an of itself, is both legal, and financially advantageous. No harm, no foul right? But what if the now inconsistent (compared to prior years) return triggers an full blown tax audit? Now you're almost certainly going to be angry, and rightly so -- I usurped your decision making and exposed you to risks that you were certainly not prepared for and possible not comfortable with either.

The decision, and it's according risks & rewards, are the boss or client's to make. If you feel their decision is unwise or exposes them to risks they may not be aware of, you should absolutely share this with them. But the decision is theirs to make.

I cannot address any legal concerns, as I am not a lawyer. Depending on the jurisdiction you work in, there may be specific legally mandated reporting requirements (which for your sake hopefully have sufficient safe harbor clauses)

  • I entirely agree because I feel that there's no right answer (it's a semi theoretical question but something we all experience at some point). – ScottMcGready Apr 9 '14 at 3:10
  • 1
    The real solution is to establish effective communication between yourself & the other party, so you can help them understand the full implications of their decision. They can then make a well informed decision -- which may still be no, but hopefully because it is their best available choice. – Shawn C Apr 9 '14 at 3:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.