Slashdot Mirror
What Should We Do About Security Ethics?
An anonymous reader writes "I am a senior security xxx in a Fortune 300 company and I am very frustrated at what I see. I see our customers turn a blind eye to blatant security issues, in the name of the application or business requirements. I see our own senior officers reduce the risk ratings of internal findings, and even strong-arm 3rd party auditors/testers to reduce their risk ratings on the threat of losing our business. It's truly sad that the fear of losing our jobs and the necessity of supporting our families comes first before the security of highly confidential information. All so executives can look good and make their bonuses? How should people start blowing the whistle on companies like this?"
Cover your ass.
how about you gather some evidence and publish it?
Of course, you'll lose your job over it. So decide now. Do you want to sleep at night? Or do you want to feed your family?
Modding Trolls +1 inciteful since 1999
Unfair labor practices, shady reporting practices, Enron, The entire legal profession, The entire political category (is it truly a profession).
The point is, why single out one area of unethical behavior? Does it surprise you that the executives in our (Techie's Rule) should be any different?
Most executives make their way to the top by lying, cheating and stealing better than the next guy.
What can you expect?
Mean what you say...say what you mean.
Ask yourself whether your "internal findings" are really representative or just attempt to CYA in case there is a problem. Coming at this problem from the side of someone whose job it is to get things done rather create objections, I frequently see security people asking for extremely expensive security "enhancements" that provide marginal if any value.
All business decisions should be made on the basis of cost-benefit analysis. Most staff positions including security usually do a poor job of assessing either side and instead focus on potential risks without quantifying them. Just because security would be better by doing X, does not mean X is good idea. If X is really expensive and your competitors do not it, your firm is now at a cost disadvantage
which depending on the industry can be catastrophic.
I really have no way of knowing whether actions you are talking about really negative expected value actions or not in the sense that over a long period the risks involved will be realized and the damage will be far greater than the cost of taking preventative action. However, changing ratings is troublesome. A much better process is a well defined override or exception procedure. The business should understand what they are doing. A rigid system that says we can not do anything rated 'Y' even if there is 100M at stake will only result in the rating be changed.
If you leak it, not only do it on the sly in a manner that can't be traced to you (or you'll probably never be hired in a position of trust again!) but have an authentication method that can PROVE it's you in case the Feds come looking and you need to roll over.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Step two: Find another job. If you take a cut, see step one.
Step three: Pull no punches when you resign. Leave a resignation letter stating that you cannot in good conscience continue to sweep serious liabilities under the rug, and that under the circumstances you have no choice but to leave. Copy the BOD. If you want to really play hardball, copy the company's liability underwriters.
Make no mistake, this is a major bridge-burning exercise. It may turn out to be the best thing that ever happened to your career, but don't count in it. See step one.
Lacking <sarcasm> tags,
No, not really. After all, there are children dying of AIDS in Africa, of hunger all over the world. Old people are being neglected, education is a mess, etc. Apparently your strategy is to give up on doing anything because we can't do everything. The advantage of this approach is to make the problem so far beyond our powers to solve that we can justify not even trying.
In response, I call your attention to the words of a sage from when things were a hell of a lot worse: "It is not for you to finish the task - nor are you free to desist from it."
It may be trite, but doing something to improve one corner of the world beats whining on /. about how bad it all is.
Lacking <sarcasm> tags,
Don't be a whistleblower, be an activist for change. See if you have a risk compliance manager and talk to them, ask for their advice. At worst, you'll get your name known in the higher echelons, at best you'll get your own way. Most people will shy away from a confrontation, but love giving advice in a tricky situation.
Your mileage may vary, and I may be full of compost. Think and do.
Do not mock my vision of impractical footwear
And why bother about security ethics when there are much more important ethical considerations like how they treat staff? Again, most companies screw most of their staff to the limit of the law.
In short: If you're looking for ethics you got off on the wrong planet.
Engineering is the art of compromise.
I have had to make a similar choice twice now and both times, I had to leave the company to feel good about the situation. In one case, I also insisted that my name be removed from all company communications and government vendor documents. I do not regret my decision, although it has cost me.
You say you are an uber security drone with a Fortune 300 company and that you *know* of fraudulent business practices to help the company earn better ratings on its security policies. I'm guessing that some of these impact SOX/404, SAS-70, and probably ALL would be of concern to the company's shareholders and business trading partners. Like it or not, you are now either complicit or you are obligated to inform oversight authorities. Your first duty
should be to your own profession's standard of behavior, your second to the company shareholders, your third to the public's interest, and last to your management chain.
You seem to be entertaining the idea of moving management's priorities to the head of the list and that would be to make yourself complicit. The fact that it would be difficult to prosecute you does not make that considered behavior any less criminal. You will have to live with that knowledge for a long time. I have friends who worked at Enron who to this day have valid concerns about the resume stain they have earned from their time there. Are you willing to bear that also?
How you go about protecting yourself from reprisals is up to you and the reporting authority, but surely anonymous 'tip' reporting is possible. Given senior management is the problem, that is a strong candidate for your response. I would also recommend you document your allegations as best you may and make them to the SEC and your local branch of the FBI. Either agency might request you remain with the company while they investigate your allegations. Otherwise, it may be time to vote with your feet and find employment elsewhere.
You more than anyone should know what will be the eventual outcome of improperly securing vital systems. Do you want it to happen on your watch or to have to answer difficult questions later
about why you did not strongly resist or report events which will lead to that security breach? Do you want the stigma to attach itself to your resume? Do you want to sleep on the knowledge that you passively participated in criminal conspiracy by voluntarily remaining silent?
You cannot fault the ethics of your superiors if you fail to execute upon your own. What are you made of? Decide,and then live with the decision. It only appears to be a difficult decision if you have an off-switch upon your professional ethics.
...he who dares tell the Emperor that he's wearing no clothes gets his head chopped off.
Take a few steps back and consider your perspective. Try reading about engineers vs. managers: http://www.fourmilab.ch/hackdiet/e4/eatwatch.html (scroll halfway down)
Many computer guys tend to be alarmist and see the world in black and white. Many security firms rate problems only based on potential damage without consideration for existing mitigations elsewhere in the system or the reality of targeting from attackers. Consider your company's situation carefully.
If, after much deliberation, you are certain legitimate problems exist that must be fixed (versus managed) then talk to the managers in their language: build a business case. You work for a company, the company's job is to make money. Security costs money. You must clearly articulate how the security improvements will make money or stop the company from losing money. It's all engineering, in the end. It's just engineering with words and numbers.
Cheers.
- jj
Standards are often slow to form, and then just as slow to be bought into. Everyone knows that they're needed, but they're too often set aside "just for this one thing."
I think one of the problems is the idea that has become prevalent that "business drives IT." This is taken by many to mean that business decides what IT does, and that IT's rules have to bend to the desires of business whenever they clash. Personally, I think this is asinine, especially because it leads to a completely unnecessary adversarial relationship. I was told once that if IT was going to start telling business what it could and could not do, they'd go back to filing cabinets and typewriters. Not at all realistic, but it shows the frustration levels that are present.
While it's true that without business, there would be no IT, the reverse is also true -- no IT, no business. It has to be a partnership. There are people on our side of the fence that are just as bad, and sometimes worse. Between business managers feeling superior because they fund IT and IT people feeling superior because they support the business applications, the battle of egos can only end up hurting the overall enterprise.
You can never go home again... but I guess you can shop there.
Public embarrassment can be useful. We publish a list of major domains being exploited by active phishing scams. These are major domains where an attacker has found a security hole allowing them to exploit the site for phishing purposes. There are 65 sites on the list. There used to be about 140, but by nagging and publicity, we've been able to get most big-name sites to tighten up. Now and then some big site makes the list, but it often disappears within hours as the hole is plugged.
So it actually is possible to get big companies to tighten up security, if you do it right.
Rule Number 1
The bottom line is this, it does not matter one lick how many security measures you put in
place. Short of completely disconnecting the network from every point of entry and encrypting
the entire network. Your security measures are not going to survive a determined attack from
someone with at most average hacking skills. The best you can do is to point out the risks
and figure out how to respond when your network gets owned because someday it is going to.
Security it always a trade off and a continuous game of cat and mouse. It is all about being open
enough to get the job done while doing your best to inform and mitigate the risk.
Got Code?
I work for a small IT company doing work mostly for law offices in our city. I fully, and completely agree that security is of prime importance and that we spend far to little time on it. The problem is guys, how do I get my CLIENTS to buy it? Most of them are fairly small and the attitude of "It can't happen to me" is all pervasive.
1. Sell the company stock short
2. Leak
3. Profit !!
(May involve forfeiture of your immortal soul, prison time and other side effects.)
"It doesn't cost enough, and it makes too much sense."
Yes, gather evidence, but DO NOT publish it. Be very careful who you tell. If you do publish it they will hunt for whoever leaked it; if they find you at the end of the trail, you will be fired and likely blackballed in your city.
Very true.
So do it anonymously. Here is how.
The most anyone will know is which city it was.
I also worked for a Fortune 500 as a Security Analyst with the same general issues. In addition to the usual corporate regulations (SOX), we were subject to numerous federal agency (such as SEC, FDIC, etc.)
... after all we were not the military or a bank. I've been here a year now..... resolving to exit the security world.
I fully understood the importance of not chicken-littling.... and making the distinction between genuine issues and theoretical. As such, I maintained a prioritized list of risks. The number of "Critical" issues -- i.e., things that could either shut down or destroy the company or lead to immediate large monetary losses with a minimum of effort went on for dozens of pages. "Urgent" and "Important" issues took up nearly another 100 pages. It was truly frightening.
Because Security was not an independent organization, of course there was a natural conflict. The Senior VP of Technology simply refused to accept our findings, and demanded the list be "fixed" and dumbed down. Critical items were dropped to mere mere "Findings". Anything less than critical was simply dropped.
California like many states has mandatory privacy breach laws. On one occasion when we had a clear breach, the law was simply ignore, despite my direct notice to the corporate lawyer.
After 5 years (well a lot sooner), and after some "close calls", I realized that the situation was not going to change. Because our internal auditors were also useless, and frankly a part of the "lets all get along" crowd. So called "security auditors" were given such strict parameters to work within, they rarely found more than nuisance issues.
After much consideration, I realized the only real choice short of going directly to customers was to leak directly to the Board of Directors. I sent information directly to their homes (several of them were former elected officials) and their home addresses were easily obtained. I also sent myself a registered letter to myself outlining containing all the email documenting my attempts to notify management and above.
I wasn't around for the effects, but after a lot of yelling, I'm told they led to very little real change, most likely because I made it clear reporting would end there. I left the company shortly thereafter for multiple reasons in addition to the nonsense above.
Sadly enough, I'm at a new company where when I learned I was to be one of only a three person IT security team for a 15,000 employee / multi billion company I mentioned that I was confident that team would be growing soon.... right. THe answer was that no