Getting an employer to secure their website immediately

Question

I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound packet capture and lo and behold there were my credentials plain in view for anyone to see. What's worse the credentials were sent back over the wire once again in plain text if the login failed.

On the upside, they're not affected by heart bleed because they don't even allow HTTPS traffic...

I have read Reporting vulnerable sites and similar but I believe this question is a bit different as first of all I'm personally affected and forced to use the site regularly as I'm employed by the company owning the site (albeit not responsible).

I have informed the IT department and got a response in the form

We have prior to your e-mail contracted a security firm that has done an extensive pen-test and among other things found your reported vulnerability. We're assessing the situation and will take action shortly.

Which to me means:

Hi we know we're leaking your passwords and we might patch it up in the coming months or maybe next year. Meanwhile, why don't you go down to the church and pray that no one empties your paypal account.

Motivated by the fact that I could just park my cellphone on wifi outside their office with wireshark running to grab the credentials of most people in the office. To me, their response is not good enough. Further more, all they need to do is to force HTTPS for all traffic as a stop-gap. This doesn't take more than a few hours for a system administrator who knows what they're doing. And it doesn't have a negative impact other than some performance (provided they have patched OpenSSL if they're affected).

My question is, how do I get them to first enable HTTPS for all traffic immediately and then inform all affected parties that their username/password credentials may have been compromised and that they need to change them at all places they use that combination. Without loosing my job.

For the record, yes, I have changed my passwords already. And I had a random 128bit password to their site to begin with because I got a feeling it was dodgy from first sight.

Answer 1

There should be an entity responsible for security, such as an (chief) information security officer. It's a usually their job to take reports like yours and find the quickest way to solve the problem without compromising business. Giving it to the IT department often makes it a "support request without stakeholder" meaning you can still work so it's not that bad from their POV.

If you don't have that, you should write a friendly mail to management on the C-Level and inform them about the business risk that problems like this pose if they don't get attention right away. They can give that role of watching over these issues to an employee who is already working in the IT department so they don't necessarily need to hire someone.

Worked for me ;-)