Slashdot Mirror

"I've pointed out the problems I see with all the plain text user names, passwords, Social Security Numbers, employee bank account numbers (for auto deposit), salaries, and other sensitive data. I've pointed out cached web pages, the possibility of arp poisoned switches and insufficient IDS, the hundreds of vendors with remote access to the internal network, and the possibility of identity theft and fraud. I've pointed out that streaming ciphers have epsilon additional latency, and our machines have idle CPU. I've also pointed out the possibility that supervisors sniffed passwords could be used to modify data in numerous ways, exposing the company to fraud, liability, and whatever penalties come with being out of compliance with department of transportation requirements.

The folks at PeopleSoft don't seem to know the first thing about security, and I know I won't get any help there. As one example, they wanted us to FTP our private data to their upload site, and they said they'd be sure to delete it fairly quickly once they had grabbed it. [No, we didn't do that.]

I have the impression that I'm not reaching the right people at my company, or somehow I'm just not communicating the risks clearly enough or forcefully enough. So far, I don't think I've really convinced the project manager that this is a risk that MUST be mitigated. I think the likelihood and impact are both being seriously underestimated.

Can you offer any advice that doesn't seem to be inherently career-limiting (such as playing whistle-blower and talking to the regulating agencies, labor department, legal department, union leaders, and so forth)?

Also, can you point me to any articles about other companies have made similar security mistakes (ideally with HTTP vs HTTPS) and suffered as a result."