Ask Slashdot: Application Security Non-existent, Boss Doesn't Care. What To Do?

An anonymous reader writes "I am a senior engineer and software architect at a fortune 500 company and manage a brand (website + mobile apps) that is a household name for anyone with kids. This year we migrated to a new technology platform including server hosting and application framework. I was brought in towards the end of the migration and overall it's been a smooth transition from the users' perspective. However it's a security nightmare for sysadmins (which is all outsourced) and a ripe target for any hacker with minimal skills. We do weekly and oftentimes daily releases that contain and build upon the same security vulnerabilities. Frequently I do not have control over the code that is deployed; it's simply given to my team by the marketing department. I inform my direct manager and colleagues about security issues before they are deployed and the response is always, 'we need to meet deadlines, we can fix security issues at a later point.' I'm at a loss at what I should do. Should I go over my manager's head and inform her boss? Approach legal and tell them about our many violations of COPPA? Should I refuse to deploy code until these issues are fixed? Should I look for a new job? What would you do in my situation?"

Comments

EASY

[houbou]

Document your correspondences to your boss when you notify vital security issues. Make sure your e-mails are not only backed-up, but you get read receipts or something showing your boss opened the e-mail (and might have read it). Keep those receipts archived. When poop hits the fan, at least, you are protected.

Re:EASY

[Penguinisto]

All that, and it wouldn't hurt to print off copies of those emails (and his responses!) and take those home for personal storage. That way, if poop-meets-fan and they suddenly perp-walk you out (before you have a chance to reach for your backups or suchlike) you still have usable documentation - this is in case any governmental authorities get involved, a lawsuit springs from it, etc..

Printing also gives you the advantage of having backups that you can walk out of the building with and not set off any alarms, since many tightly-regulated companies lock down the use of USB sticks, external hard disks, and etc. (my last employer -- a web-banking software house-- would literally fire you on the spot if you got caught using a geek stick or external drive on their desk/laptop equipment or servers - at least if you do it w/o prior written manager authorization and only on authorized devices.)

To top that off, the printed copies are protection against an 'oops - our retention is only set to two weeks and the backups were corrupted somehow; sorry, sucker!' move. F500 firms generally blow away anything in the inbox that's more than a couple of weeks old anyway, so if you forget to archive it off to a .pst or another folder, it's usually gone by week 3, with no recourse.

Meanwhile, it wouldn't hurt to have a bit of a side conversation with someone in legal (for a start), then escalate it to formal conversations with them via email (again, print those suckers off) should nothing get resolved.

Re:EASY

[MillerHighLife21]

This. My last job was at an after market buy/sell/trade website where I got to take over the whole project mid-rebuild after the previous staff walked out/botched the job/etc. The user base was under constant attack from phishing, fraud, scams doing literally everything you could imagine including hacking accounts. The users complained about it constantly, people were losing trust in the site.

The owners only concerns were that I add new functionality. One of them wanted me to build a blog in the midst of all this. Also were totally willing to sell user information to ad companies if it meant better ad deals.

The core of the entire business was the part that was under attack. Being the only programmer there and realizing that there would not be a job left to complain about if I didn't do what needed to be done, I finally just started doing everything once all attempts at communicating the level of importance had failed. Built and integrated security features that had been present in the previous platform. Developed anti-phishing tools. Added intrusion detection for accounts. Built my own anti-spam system. By the time I was done with it, user complaints had nearly stopped and people were significantly more comfortable. Trading went back up. Crisis was over.

Owners didn't think I was working hard enough.

In the end I collected enough numbers to measurably illustrate the impact that my work had on the company, so I resigned with an awesome resume addition in hand that promptly landed me a muuuuuuuch better job with a better company.

Moral of the story: Do your due diligence. Try to communicate the importance. If you can provide numbers that put things in perspective for somebody more business minded - do it. At the end of the day though, owners who don't understand probably won't care. In this particular situation, if I didn't take the action that I did the company would have gone under. Others may be different though, so you need to be able to measure the cost of a breach in financial terms because that is the ONLY thing the owners will care about.

Outside of that, C.Y.A.

Re:EASY

[Jeremiah Cornelius]

Find another job.

These are not the only problems, just the ones you have seen.

Re:EASY

[sneakyimp]

Yes it's definitely a good idea to cover one's ass, but curing a problem is a lot harder than preventing one. If it were me, I would go get the access logs (like SSH logs and apache logs) and point out all of the bruce hack attempts that are likely to be in there. E.g., brute forced ssh login attempts, SQL injection attempts, etc. I would then say to boss-man: "THESE ARE HACK ATTEMPTS and they will ultimately succeed and I want to fix them. If you don't let me fix them, you will have to take the blame." I do think that it is reasonable to draw attention to security problems even if it does step on some toes. Putting marketing folks in charge of code development is particularly infuriating to me as a developer. Rat those hacks out. As for your boss, I'd give her/him a few chances to fix and then go around. I believe it was Gen. George S. Patton that claimed he would always shift his loyalties to whoever was highest up the food chain once he made contact with them. It's a bit cutthroat, but sometimes called for if someone is doing the wrong thing.

Re:EASY

[Garridan]

Cover your ass BEFORE you talk to somebody in legal. The legal department is there to protect the company and NOT its employees. A good legal dept will say "hey, this employee is trying to reduce our liability" -- but a bad one will say "this employee is a liability" and shoot the messenger.

Re:EASY

[Tablizer]

Good advice, but minor addition: CC a fair number of other people. If your boss claims "I never got the message", then you have evidence in other people's in-boxes that at least you made a good-faith attempt to notify your boss and that the email system worked for everybody else.

Further, CC'ing others tends to make people more aware of a concern because they have to also consider how others are going to view the suggestions. Thus, it's a form of psychology.

Final advice: look for another job. Stubborn fools drag everybody down with their self-made Titanic. BeenThereDoneThat. Complaining to others frequently rarely works, and hurts your career.

Re:EASY

[Penguinisto]

Agreed. Always line up the ducks before you go shooting.

Re:EASY

[tsa]

Indeed. However good you document the lack of progress and the disinterest of the managers, when something happens it will be your fault and you will have a shitload of problems. Leave ASAP.

Re:EASY

[cdrudge]

Document your correspondences to your boss when you notify vital security issues. Make sure your e-mails are not only backed-up, but you get read receipts or something showing your boss opened the e-mail (and might have read it). Keep those receipts archived. When poop hits the fan, at least, you are protected.

I'd print them out. That way when you stand in the unemployment line, you'd have something to burn to keep you warm on cold winter's days

A print out may document it, but if the shit really does hit the fan, documentation may not cover your ass much.

Re:EASY

[jonnyj]

I agree, but I wouldn't be underhand and I certainly wouldn't use read receipts. That looks horribly like the very worst kind of arse covering.

You shouldn't go over your boss's head. Juggling a large number of conflicting priorities is what managers are paid to do, and you won't do yourself or anyone else any favours by undermining your boss's judgement in that way. But you should also consider the risk that she consciously has her own best interests at heart rather than the business's interests. She might have the view that, in the event of a security debacle, she will pretend that the team messed up and failed to follow instructions, and simply ride out the storm. In the meantime, she looks efficient and appears to gets jobs done quickly with a minimum of fuss.

Instead, you should sit down with her and clearly express your concerns. You should then follow up your meeting with a very clear email that summarises the conversation. You need to start with an assertive but non-hostile comment that leaves no-one in any doubt what has happened - something like this, "As we discussed earlier, these are the security issues where I believe that we are falling short of regulatory expectations..." Print out that email and take it home with you.

At that point, your boss has three options. 1. She can fix things. 2. She can escalate up the food chain, so that someone bigger than her can decide whether poor security is really in the company's best interests. 3. At huge personal risk, she can quietly ignore you.

Middle managers tend to have pretty strong survival instincts, so option 3 is very unlikely to to fly. Option 2 is pretty likely, and her manager might well say that security is too expensive/awkward/boring/inconvenient. If that happens, you're probably better off working some place else where you can be proud to turn up in the morning.

Re:EASY

[Anonymous Coward]

Document your correspondences to your boss when you notify vital security issues. Make sure your e-mails are not only backed-up, but you get read receipts or something showing your boss opened the e-mail (and might have read it). Keep those receipts archived. When poop hits the fan, at least, you are protected.

Don't just keep them backed up online, but back them up elsewhere, such as a hard copy. Companies can and do delete old emails, intentionally due to relationship to a particular topic and as a policy to avoid maintaining large amounts of unused data.

Re:EASY

[roc97007]

He asked what we would do. In the spirit of that, I would (and have, in a previous job) do what houbou says above, and then take everything to the appropriate higher authority. Considering that things are most probably going to go TU anyway, what do you have to lose? (This assumes you have a high degree of confidence that you understand the issue and your analysis is correct.)

In my case, it caused an internal upheaval which resulted in some things getting fixed, but not enough, and when crap hit fan some months later, the company barely survived, and then only by becoming a much smaller company.

I was one of the employees laid off in the debacle, but I figure that had I not spoken up, the collapse would have been worse if anything, and I would still have been laid off, and I take comfort in the fact that at least I gave it my best effort. In fairness, I wasn't the only person who raised alarms. I guess what I learned is that companies have a powerful inertia, and it's not easy to correct a massive mistake in an acceptable amount of time. I can sympathize with people who see the approaching wall, say "oh well" and start updating their resume.

Re:EASY

[JoeMerchant]

If you're needing paper backups to CYA for a perp-walk, you can probably find better pay and benefits in a less stressful job at another company.

Re:EASY

[Anonymous Coward]

printing the emails is fine but how to do authenticate them? i could literally open up work type of anything i want and say it was an email my boss sent me. how can you ensure that a print out it legit.

Re:EASY

[Bogtha]

Meanwhile, it wouldn't hurt to have a bit of a side conversation with someone in legal (for a start), then escalate it to formal conversations with them via email (again, print those suckers off) should nothing get resolved.

You don't have to approach them as if you are blowing the whistle on your boss. Just tell them you are concerned about your personal liability should you get caught breaking the law.

Re:EASY

[asliarun]

Indeed. However good you document the lack of progress and the disinterest of the managers, when something happens it will be your fault and you will have a shitload of problems. Leave ASAP.

Yes, agree 100%. Leave ASAP.

The other way to think about this is - any organization is only as good as your boss. If she or he is is veritable shite, the organization is as well. You are not only wasting your time, you are doing the equivalent of hanging out with a bunch of dicey "friends" who might go do something illegal when they are tanked up.

Re:EASY

[Nefarious Wheel]

Marketing is driving the software?
They don't care about security?
System administration is outsourced?

Quit. Leave now. Take only your jacket. Your adrenals will thank you later.

Re:EASY

[TheCarp]

Potentially good advice, potentially bad.

I work at a large company where this wouldn't fly for one reason: We have a security policy that specifically forbids it. Under the security policy, we have specific guidance for who must be told and, very specifically, that it should not be discussed or divulged beyond that.

So check the policies first, because, just sending a message out to a large group of people may get you in hot water itself for violating policy.

oh and.... fuck that shit entirely, get yourself back on the market, if you have to hammer them to get them to take real security issues seriously, its not worth it.

Re:EASY

[DogDude]

Why find another job? That doesn't make any sense.

Re:EASY

[Nefarious Wheel]

Seriously. What Jeremiah Cornelius said. Your job is officially on an escalator to Hell and the steps have just flattened out.
They're doomed. Don't take it personally, just go.

Re:EASY

[MugenEJ8]

If you don't let me fix them, you will have to take the blame.

Word to the wise. Don't ever tell your boss what they need to do. I've been in the work force for over fifteen years, and this holds true for small business all the way up to large enterprise.

Best case, you've aggravated them and they will retaliate somehow. Worst case, you've aggravated them and they will retaliate somehow.

Re:EASY

[sneakyimp]

I would imagine a good boss would appreciate a heads up. On the other hand, I'm self employed and have been for more than fifteen years.

Re:EASY

[Anonymous Coward]

So, how were things at MtGox?

Re:EASY

[Anonymous Coward]

Why find another job? That doesn't make any sense.

If only because it is easier to find a job when you already have one than to find a job when you're unemployed.

Re:EASY

[alexander_686]

The short answer is to follow the hierarchy and document everything. Document that you told your boss – that’s CYA.

Then go to your boss’s boss. Try that. Try to be constructive and offer solutions or at least avenues that should be pursued. Don’t offer specifics – that is somebody else job or a project in of itself. If you have to go negative, don’t tear down your boss, tear down the system.

Next step is fuzzier. Maybe your boss’s boss’s boss. Maybe Legal. But the steps are basically the same.

Finally, if all other steps fail, as a last resort, call the anonymous hotline. If you do work for a public company there should be a phone number that you can call. It should go to a outside group that reports to the board, not to the C-Level people. In theory it should be anonymous and they can’t penalize you for whistleblowing. Some organizations do this better than others.

Re:EASY

[Darinbob]

Why? If the pay is good just keep at it. An employee never needs to become emotionally invested in the company. It's perfectly acceptable to go home every day and complain that the job sucks and everyone there is an idiot. A company that has problems means that there will be a lot of work coming down the pipeline to keep you employed.

It is hubris to leave a job because of management problems at the company that don't affect the actual job, because no one is that important and there are no perfectly maanged companies out there. Yes it's ok to leave because the management problems are causing lots of stress or the hours are too long or something that affects you personally.

Leaving the company will not fix the problems, but will create a lot of headaches while finding a new job and wasting time learning the new job once there.

The only important thing to do here is to make sure that you inform bosses of any legal issues so that you cover your ass and don't look complicit, but that's easy to do.

Re:EASY

[Anonymous Coward]

In this particular situation, if I didn't take the action that I did the company would have gone under.

I get the aspect of enlightened self interest, that you moved up in the world thanks to the resume and all of that... However, a company that is managed like this deserves to go under. It's just going to become bigger and bigger, the incompetent management will once again run the company into poopoo, the next person in a position to turn it around probably won't, and the only difference is more people will lose their jobs.

Re:EASY

[Anonymous Coward]

Indeed. However good you document the lack of progress and the disinterest of the managers, when something happens it will be your fault and you will have a shitload of problems. Leave ASAP.

Do a "Snowden".

Re:EASY

[dave562]

This is the best advice. I will add a couple of things.

DO NOT GO AROUND YOUR BOSS. That will get you fired. Raise the issues in email, document them and move on. It is ultimately your boss' responsibility, and the responsibility of people above your boss. Unless your title is CSO or something similar, this is not your problem.

If you want to help your boss, do a risk assessment. Detail what you perceive to be the risks. Detail the potential problems of not doing anything. More importantly, detail what you think the potential solutions are, and what is involved in implementing them. This is important because you want to be constructive, and want to prove that you have put some thought into making things better, and that you are not just a whiner.

Your success or failure will depend on how you present it. The tack I would take with your boss would be something along the lines of, "Security is obviously not a high priority around here. However, I have recognized these risks that expose the company to potential liabilities under COPPA. Here are my suggestions. Now that I have documented these, I can stop thinking about them and focus on the other priorities that our team has to address."

Keep in mind, you are not going to make any friends doing this. Once it is in email, they have to act on it. To not act on it makes them liable. Keep in mind, it is not your job to do your boss' job. Unless your job description specifically says, "Mitigate security vulnerabilities in code before deploying to production.", this is not your job. Your job is to do what your boss tells you to do, just as her job is to do what her boss tells her to do, all the way up the chain to the C-level executives and board of directors.

Re:EASY

[TapeCutter]

if you have to hammer them to get them to take real security issues seriously, its not worth it.

If you can convince them then it is definitely worth it since you will have helped secure the jobs of everyone else at the company. The difficult question is at what point does the boss' disinterest in network security become a threat to everyone's job?

Having said that, the most reliable sign that the situation is not going to change is if your boss treats you like a personal assistant rather than a professional advisor.

Re:EASY

[styrotech]

Printing also gives you the advantage of having backups that you can walk out of the building with and not set off any alarms, since many tightly-regulated companies lock down the use of USB sticks, external hard disks, and etc. (my last employer -- a web-banking software house-- would literally fire you on the spot if you got caught using a geek stick or external drive on their desk/laptop equipment or servers - at least if you do it w/o prior written manager authorization and only on authorized devices.)

I don't think the company in question here cares enough about security for this to be a problem.

Re:EASY

[Anonymous Coward]

A new job may not help. I've worked for several major companies (I won't give clues like the OP did), and I see the same happy-horse-shit time after time.

The dev team pushes code known to be buggy/insecure and says they'll fix it later. They almost never do.

The site goes down/gets hacked, the dev team manager gets a promotion for making deadlines and the sysadmin team gets beat up for the site being down/hacked.

If you do go for a new job, think about what you'll say in the interview, because while you may be 100% in the right, if I'm interviewing you I will think twice about hiring you. I'm sorry for that but it's true.

Re:EASY

[Anonymous Coward]

This.

There's 2 approaches to dealing with bad management; waste time covering your ass, leave.

The third approach; spend an ungodly amount of time doing the job right from the get go; is a tried and true method of building great, marketable IT people but often has the result of extending the reign of some really fucking stupid motherfuckers who deserve every last bit of fucking pain they deserve including ending up homeless because the damage they do to people's lives and the economy, other companies they do business with, etc is very real and very shitty .

E.G. We can't give out bonuses this year because Vendor Asshat "Fined" us on a shipment that was 1 day late.
E.G. We can't give out raises because dumbfuck son of the company owner has to give everyone the 3rd degree on every fucking thing so they stop communicating with them and things fall apart.
E.G. We have to fire people and consolidate business responsibilities because I need a new Ferrari.
E.G. My boss 2 companies ago who had literally, and I mean literally, 3 heart attacks due being yelled at by the shit CFO. Nobody communicated with him, company went through bankruptcy, twice.

If it makes sense for you to stay, cover your ass; Get a hard and digital copy of those e-mails together and keep them at home. When they swoop down from upon 'nigh and try to can your ass or end up in a shit storm of legal trouble, remind them it was their decision. When they fire you, choose very carefully who you show what you have to because depending on your situation you may be starting a serious backfiring shit-storm.

The only reason bad management exists is because good employee's enable it.

You CANNOT fix stupid, you have to Eradicate it

Re: EASY

[Anonymous Coward]

Sounds like bebe.

Re:EASY

[Anonymous Coward]

+1 on being a professional and seeing things through.

* Do your due diligence.
* Assess whether the situation can be improved or if it is basically stuck.
* Have your backup plan(resume/interviews/references)

Either the situation changes or you will need to leave. You sound like you care about your reputation and the reputation of the company. You want to do the right thing and you want the company to do the right thing. Take the "offer three times" approach of gift giving, bringing side dishes, and of refusing out of politeness: If you've made your best effort three times, and the boss/environment resists, then it's time to leave amicably.

On doing the right thing even if the higher ups aren't onboard with it, that can be good/bad, depending on who/what the situation is like. In some cases, it puts you at risk of liability if a security issue does come up and it comes out that you've been affecting security updates/etc.

But yeah, it's a bad position to be in, especially if its a company you have strong ties/associations with.

Re:EASY

[Grishnakh]

No, don't leave. Find a new job, get an offer, accept it, then leave.

It's extremely unlikely they're going to get into any criminal legal trouble in that time, and even if they do, it won't be traced to you. Get out and just find a new job. Don't try to be a hero: America hates whistleblowers, and there are zero protections for them here. If you reveal the problems, you'll never get a job again, because you'll be seen as a liability. Anyone who's ever blown the whistle on anything will tell you this. It just isn't worth it. The only way to blow the whistle is to do it anonymously somehow, so it doesn't taint you with a reputation as a "rat fink".

Re:EASY

[slick7]

Document your correspondences to your boss when you notify vital security issues. Make sure your e-mails are not only backed-up, but you get read receipts or something showing your boss opened the e-mail (and might have read it). Keep those receipts archived. When poop hits the fan, at least, you are protected.

Then you can be labeled a leaker instead of a whistleblower. Your documents will be prime evidence of your paper terrorism, may you get what you deserve.

Re:EASY

[Anonymous Coward]

I would suggest after covering his ass with printed emails, that he should try and notify security experts, if he is a slashdot reader he has heard of the top ones and report this to them, let them hack the system, then report the blatant holes in the companies system. These experts should also report to the higher ups (NYT, CNN) in the press/media the company name and how they blatantly ignored warnings from an employee (aka unknown source within the company), on patching up these holes.

The problem I see is the same old story we read about, companies do little to nothing after being warned and called out by security experts to patch up there systems.

Re:EASY

[Anonymous Coward]

However this is how Salesforce.com implementations happen very often.
Some companies will do a professional job but others will not. The motto is "No Software".
(Actually this logo was recently removed. And there is plenty of opportunity for muffups if you try hard enough)
I'm not so sure your advice is best for this person. He has already gotten directive from management and doing anything else including leaving is only going to hurt them and him. As for the need for security, sure but trying to change the culture takes a while. He can take some steps on his own perhaps now but if he leaves they will have nobody who knows anything about security. Is this good for the company's users? CYA And Leave is not intrinsically ethical.

Re:EASY

[phantomfive]

Just out of curiosity, how many companies have you seen that DO take security seriously?

Re:EASY

[chameleon3]

You don't have to approach them as if you are blowing the whistle on your boss. Just tell them you are concerned about your personal liability should you get caught breaking the law.

Remember, the lawyers are there to protect the company, not you. Seek your own counsel first.

Re: EASY

[Anonymous Coward]

Honestly...it reminded me a little of Slashdot. It was a 14 year old site with a big community around it and it felt wrong to let it tank because the people running it had no idea what they were doing.

Re:EASY

[Anonymous Coward]

Making your superiors look bad is an excellent way to become unemployed and unemployable.

Re:EASY

[Garridan]

Evaluate if it's worth the risk of blowing the whistle. Are these "rapists kidnapping kids" level of COPPA violations, or "accidentally picking up a 13 year-old's email once and a while"? I'd blow the whistle on the former regardless of personal risk, and simply quit over the latter if I thought the company would throw me under the bus in case of a lawsuit / criminal charge.

Re:EASY

[mysidia]

Unless your job description specifically says, "Mitigate security vulnerabilities in code before deploying to production.", this is not your job. Your job is to do what your boss tells you to do

This depends on your company, the organizational structure, and what your job actually is.

If your boss asks you to do something that you can clearly demonstrate is illegal or against explicit company policy, and you have it in writing from the boss confirming they know about it, and to ignore the company's own policies ---- without the proper approvals from higher levels of management, then it might be time to visit HR, in order to report the policy violation so the HR staff can investigate/mediate.

Some companies may very well have policies that say "No employee may deploy new software with any known security problems to a public-facing server."

Frankly, I don't see what business a Senior Architect has doing deploying any code supplied by another department. Deploying software is clearly a system admin job, not a software developer job.

If dealing with the security issues, or approving the release is not your job --- then you should not be standing in your team's way, or your boss' way.

You might want to request a 4-way meeting with your boss, someone in QA, and someone in security, about the issue, and make sure the issues are in the relevant departments' radars, so that they will be addressed.

Re:EASY

[rossz]

Mine does. We have to be because we are a regular target. Every line of code goes through a review process before going live in production. Even a single line change I did today, which was no more complex than changing the spelling of something, was checked by another person when merged to production.

Re:EASY

[Anonymous Coward]

+1 for turning a shitty situation into an opportunity.

+10 for having the ability to single-handedly protect the company from itself.

-1000 for protecting a company that clearly deserved to go bust.

Re:EASY

[Anonymous Coward]

Wow there are a lot of naive people out there. "Talk to the compliance officer | HR | document this | document that | etc."
GTFO, just like the miranda warning, once you learn of things like this, EVERYTHING WILL BE USED AGAINST YOU. There is nothing you can do or say or document that will protect you from nefarious cocksuckers at companies.

Think of it this way, it's about time to learn a new trade anyway isn't it? ...before you are laid off, outsourced, and fucked over like everyone else in America brought to you by the typical yellow-bellied cocksucker suits of world.

Do you know why lawyers and management where ties? To keep the foreskin from covering their head.

Re:EASY

[phantomfive]

That's awesome.

Re:EASY

[davester666]

If they are worth anywhere near the salaries they take home, they will recognize that as absolute bullshit. If you were concerned about your personal liability, you would go to see a lawyer that would represent you, not a lawyer that represents somebody else [namely, the corporation].

And if you do believe the company is violating the law, you totally need to bail ASAP.

Re:EASY

[sjames]

I wouldn't bet on it. Sometimes it's the companies that don't give a damn about customer security that are the most deeply concerned about their own.

Re:EASY

[Anonymous Coward]

It's perfectly acceptable to go home every day and complain that the job sucks and everyone there is an idiot.

In what world is this "perfectly acceptable"? He's not shelf-stacking for Walmart. He's in a position of some responsibility at a company that does not take its responsibilities seriously. That's a recipe for a lot of stress, which is in turn a recipe for an early death.

A company that has problems means that there will be a lot of work coming down the pipeline to keep you employed.

Oh so now he has to worry about there being enough work to keep him employed? Plenty of other companies will have enough work to keep him employed. Again, he's not a shelf-stacker at Walmart ... are you?

It is hubris to leave a job because of management problems at the company that don't affect the actual job, because no one is that important and there are no perfectly maanged companies out there.

Oh God spare us the binary analysis. The quality of management is on a spectrum, and you can improve your lot significantly by moving from a company with very poor management to a company with very good management. It's ludicrous to say there's no point moving unless you can move to a company that has perfect management. This isn't hubris, it's basic optimization plus the common sense to see that real-life situations are never binary. (Repeat after me, *sigh*, oh well I guess this is Slashdot.)

Leaving the company will not fix the problems

A minute ago you said don't get emotionally invested, now you're saying he should care whether or not the problems get solved if he leaves?

but will create a lot of headaches while finding a new job and wasting time learning the new job once there

Oh yes the famous "headaches" caused by finding new challenges to explore, and the famous "wasted time" learning new things. Meanwhile you're not prepared to look at the time he's wasting because of the problems at his current company?

Seriously the worst advice I've ever read. You must be quite jaded already.

Re:EASY

[Joce640k]

Marketing is driving the software?
They don't care about security?
System administration is outsourced?

Quit. Leave now. Take only your jacket. Your adrenals will thank you later.

Wuss.

The sensible option is to learn to relax. By informing your boss, you've done your job.

If you really want to make an effort then you can make a weekly report called "Security status bulletin" listing/naming the worst problems plus their possible consequences. Send it to the people who need to know.

Keep evidence, make sure other people know you repeatedly told the boss, collect your wage packet, go home every day. If you think this is unprofessional you need to Read more Dilbert.

Re:EASY

[gnasher719]

Cover your ass BEFORE you talk to somebody in legal. The legal department is there to protect the company and NOT its employees. A good legal dept will say "hey, this employee is trying to reduce our liability" -- but a bad one will say "this employee is a liability" and shoot the messenger.

And _talk_ to someone in legal. No email. As soon as you send an email or anything in writing, you have created a liability. If _you_ are the reason why a vulnerabiility lead to a lost court case, that's on your head. Even if you have a _good_ legal department.

Re:EASY

[Anonymous Coward]

If any of the issues are potentially illegal, don't document them, especially not using e-mail.
When the shit hits the fan, the cops will find this incriminating material and will use it as evidence that you're an accessory.
Plausible deniability is important. Also, start looking for a new job.

Re:EASY

[Anonymous Coward]

The best thing is to also change job roles so you're in a position where you don't see it. Then just don't worry about it. If you're having trouble stopping worrying about it, start with one liter/week of vodka and work up from there. Also repeatedly watch this

Re:EASY

[Anonymous Coward]

If you do whistle-blow, do it from a clean install of Tor bundle and don't do it with anything you use outside of that browser (personal email, even if it's pseudonymous, is bad). Make a new email with false info if you have to. Don't use or say anything that can be tied back to you. If you're the only one working on the thing you're whistleblowing about, you should reconsider, because THAT can be traced back to you if you're only leaking stuff you worked on.

Re:EASY

[R3d Jack]

I agree with everything above. Furthermore, I found this thread through the RSS feed and read it because it is interesting. How many people at YOUR company have already read this? You provided enough information to identify you. All that needs to happen now is for a body-stacking coworker to go to your boss. Sorry to be negative, but been there, done that.

I understand exactly how you feel. If you are as competent as you sound, find a new job and then leave. Make sure the new place is more stable, so you can keep your conscience clear. BTW, +1 for having one.

Re:EASY

[jafiwam]

Document your correspondences to your boss when you notify vital security issues. Make sure your e-mails are not only backed-up, but you get read receipts or something showing your boss opened the e-mail (and might have read it). Keep those receipts archived. When poop hits the fan, at least, you are protected.

Yes, this is obvious. Then print out the replies to the emails, take them home and make more copies.

Look for another job maybe, depends on what other aspects of the job you like / dislike.

Last time I checked, COPPA doesn't throw anybody in jail, and would fine the company, not the employees.

I might keep a journal at home about the events (on paper) that you can go back to and use to recall how things went.

Then, when the mommy brigade shows up to lynch the company and the feds get involved, throw your boss under the bus with gusto.

I might try mentioning to the higher ups that there are problems like this ONCE but don't be a pest about it. Chances are they know already an also don't care.

Re:EASY

[Anonymous Coward]

"I'm going to have to explain this to a judge at some point, so as my superior you need to be very clear about your views and instructions."

That one sentence saw an old boss of mine resign as they realised just how much trouble the company was going to be in at some point. It took roughly six months from that point, then the MD was in court and the company went bust.

Got to be cruel to be kind sometimes. Don't just make a papertrail, make it blatantly obvious you're doing so to protect yourself from prosecution and dump them in it instead.

Re:EASY

[Jmc23]

People like you are why the world is such a shitty place right now.

Re:EASY

[Jmc23]

You're an apathetic shit with no spine who only cares about themselves. Please do not spread your bullshit to other people, we don't need more of you shits fucking up the world.

Re:EASY

[Anonymous Coward]

Why find another job? That doesn't make any sense.

If only because it is easier to find a job when you already have one than to find a job when you're unemployed.

Well, that and he's in a toxic shithole currently. No harm in getting TFO and saving sanity and (hopefully) not being there when (not if) the shit hits the fan, regardless if he has a job lined up or not.

Re:EASY

[Grishnakh]

Exactly, and that's a great point about other people: if you've already piped up and complained to your boss about the problem, and no one else has, if word gets out somewhere about this problem, who do you think is going to be fingered for it? You, because you were the one who obviously thought it was a big problem before.

No one is going to appreciate you for publicly identifying security vulnerabilities on some private company's website. This isn't worth ruining your entire career over.

The important thing to remember about whistleblowing is: if you do it, you will never have a job again. Weigh that cold, hard fact against the severity of whatever it is you think people should know about. If lots of people will die if you don't, then it might be worth it to you. Website vulnerabilities? No one's going to care. No one even cares when millions of credit card numbers or other private details get leaked/hacked from some website.

Re:EASY

[Anonymous Coward]

Best of luck, shark chum. I was *fired* for telling my boss that his emergency-service-inaccessible 3,000 gallon liquid oxygen tank sitting five feet from continuous open sparks was a really bad idea. BTW, This guy makes military shotgun silencers, medical surgery equipment and fucking rocket ships...you know, that go into space....

Re:EASY

[Cederic]

And if you do believe the company is violating the law, you totally need to bail ASAP.

I wouldn't work anywhere very long if I took that approach.

Instead a very constructive, "Hey, is that the Compliance department? Who can help me assure that we're doing the right thing here?" works wonders.

You don't claim you're trying to protect yourself, you make it clear from that outset that you're looking out for the company's best interests.

If you then find out that breaking the law is corporate policy then that's the time to leave. As described, it's a compromise between speed of delivery and due diligence to assure compliance, and that's where a good compliance department will provide adequate assurance that the balance is being reached.

Re:EASY

[Cederic]

I work at a large company where this wouldn't fly for one reason: We have a security policy that specifically forbids it. Under the security policy, we have specific guidance for who must be told and, very specifically, that it should not be discussed or divulged beyond that.

Hell yes. Tell as few people as possible about security issues, whether it's corporate policy or not.

Appropriate escalation is massively different to a public broadcast. Proportionate and responsible engagement with relevant individuals will upset at most the direct manager, and even then only for skipping past him.

Re:EASY

[Cederic]

I like your approach - sensible, measured, responsible, pragmatic and realistic.

I'd challenge only one thing: If the manager adopts option (3) and you genuinely believe the law is being broken, I would escalate.

My manager is never senior enough to tell me to break the law.

I also don't flee a good job purely because I disagree with the chosen compromise between legality and convenience. I do assure that the lega/compliance department have had the opportunity to review and advise the senior manager making that decision.

Re:EASY

[TheCarp]

Exactly. And...if the relevant individuals don't care, why would you care more than them? It is, quite litterally their problem. If it hurts the company and your job, that may be your problem but.... and I can't stress this enough.... if that happens, for those reasons, then.... your problem is not the security problem; its the management; and you should stop trying to help them more than they want to be helped, and plan your exit strategy before it comes crumbling down on top of you.

Re:EASY

[Anonymous Coward]

The owners might have deserved it, but the other people working there didn't. Plus, the user base didn't deserve to be constantly attacked/victimized by fraud either. I have no doubt that the owners will get what they're going to get one day because the pattern of their behavior hasn't ever changed.

Re:EASY

[Anonymous Coward]

Why give them ideas?

Not a question of if, just when the nightmare happens, and YOU are left holding the bag. This IS what will happen. No amount of ass-covering will protect you.

Leave. NOW. While you still can.

Re:EASY

[AbominousSalad]

And if it's possible that there's a criminal negligence case against your boss, pursue it proactively. Throw the whole company under the bus.

It's either the company, or the users.

Re:EASY

[Jeremiah Cornelius]

Whisleblower into woodchipper syndrome.

Re: EASY

[Anonymous Coward]

Couldn't agree more, there are issues at every company. As long as it doesn't have a negative effect on your personal life you shouldn't care too much. Just make your boss aware of the issues from time to time and you're doing a good job, in time they will pick it up or you can say "I told you so" when the site gets hacked (if it ever happens) and they'll listen next time.

Re:EASY

[RockDoctor]

Meanwhile, it wouldn't hurt to have a bit of a side conversation with someone in legal (for a start),

The first legal that you should be talking to is your own legal department - the ones that your trade union hire to protect you (their customers and employers) from your employers.

You do pay your union dues don't you? Otherwise you are so totally fucked. They will sell your ass to Big Boylover in the jail and your family into white slavery. For starters.

Find a new job

[Anonymous Coward]

Find a new job. Thread over.

Re:Find a new job

[Aighearach]

Or just care less.

Re:Find a new job

[mlts]

Seconded. This is a pile of manure just waiting to fall onto someone as a scapegoat, and it might be that the application is already compromised.

Approaching legal won't do the trick. They will immediately turn around and tell the boss that so and so have gone over their head... and this won't be good for future (or present) job prospects.

Were I in your shoes, I would be honing my LinkedIn profile, updating the resume, maybe shooting for a certificate or two for keywords, and starting the hunt.

In previous IT jobs, I've heard the mantra, "security has no ROI" plenty of times, followed by, "Geek Squad can fix it if we get hacked" when I ask the obvious followup question. When you hear that song and dance, run.

Re:Find a new job

[Anonymous Coward]

Try to find a job where your understanding of security issues is valued. They're going to resent you if you manage to force them; that's potentially a lot of stress coming your way in the future.

Re:Find a new job

[Anonymous Coward]

Or just care less.

this is the root cause of the original problem, why would you keep compounding the issue? clearly the OP takes some semblance of enjoyment and self satisfaction from his work.

with an attitude like quoted above and people wonder why the government is managing by budget crisis, continually kicking the can down the road until its someone else's problem

“The price good men pay for indifference to public affairs is to be ruled by evil men.” - Plato

Re:Find a new job

[Penguinisto]

Yes and no... nowadays, with mandatory reporting in some cases, and every newly unemployed developer on the planet able to post to any number of disclosure lists, I'm not seeing too many management types left these days that would take such a stupid risk.

Re:Find a new job

[DuckDodgers]

The problem with simply caring less is that if the company suffers from a well-publicized or otherwise expensive hack, your boss may manage to shift the blame onto you. Then you're looking for a job while unemployed. It's much easier to do a job search while you're still employed, because you can take your time and pick the best opportunity that comes up instead of grabbing the first thing available, even if it sucks, because you have no income.

Re:Find a new job

[mysidia]

Yes and no... nowadays, with mandatory reporting in some cases

So? They can ignore mandatory reporting, as long as it's not in the news and no end users can prove the breach. As long as management never acknowledges that there ever was a breach (experts can be cherrypicked to investigate, and eventually come to the conclusion that there was no breach for "formal documentation purposes" --- regardless if there was or not).

If the authorities find out; it's just some fine anyways.

Re:Find a new job

[Joce640k]

Or just care less.

this is the root cause of the original problem, why would you keep compounding the issue?

You need to read more Dilbert. Seriously.

clearly the OP takes some semblance of enjoyment and self satisfaction from his work

He should get a hobby...?

submit to legal department

[i kan reed]

Explain the possibility of liability. Let them investigate the risks. Problem will then resolve itself from the top down.

Re:submit to legal department

[Anonymous Coward]

That will only work if the chief legal counsel believes the odds are against them.

Re:submit to legal department

[i kan reed]

That's, sadly, the extent of his employer's financial liability then and his manager is making the financially sensible choice. If the laws aren't in favor of the customer enough to make an incentive, then that's everyone's problem, not the OP's.

Re:submit to legal department

[jvj24601]

That will only work if the chief legal counsel believes the odds are against them.

We're in IT; the odds are never in our favor.

Re:submit to legal department

[Anonymous Coward]

Nobody likes a tattletale, esp fortune 500 companies.

Re:submit to legal department

[Finallyjoined!!!]

Where I work, at an ISP, the "meat space" buildings are all uninsured, however the datacentres & headends are. i.e. it's cheaper to compensate bereaved relatives than the increase in insurance premiums required to provide the cover.

Re:submit to legal department

[Anonymous Coward]

This.
Make sure to cya and then let someone else worry about it.
You aren't paid enough to worry about this.

Re:submit to legal department

[Anonymous Coward]

if it isn't resolved this way, then it's their calculated risk and decision to make and they can't say they weren't given the math.

they tend to not care because more security does not equal more money. nobody sees insurance payouts like they do income or profits on investments, even though it's all just money. also, people like you have a tendency to doomsay and overreact and they trust you more than you trust yourself to deal with it when it actually happens - however naive that might be of them, it's not their fault they think this way because it's true in most other situations.

write up your report detailing the risks, include published stats from other companies like yours that include costs after hacking so they understand the potential cost of inaction and they will never be able to claim you didn't warn them.

keep in mind their business strategy is not "we'll blame the tech if we get hacked" - their business strategy is to make money. your job is not to ensure it gets done, but merely to ensure they understand the risks. if you feel your hallway conversations aren't getting the job done, then YOU'RE not getting YOUR job done. I totally agree with parent, do some actual homework and put it in a letter first to your boss. if he doesn't react, then maybe CEO or legal, but that could be interpreted as going over your boss's head and usually bad.

if your direct supervisor has acknowledged it and didn't act, that's on him, but do everything you can to ensure he makes an informed decision regarding security priorities by actually understanding the potential costs.

and guess what - you may not be approved to work on it, and be forced to do so in your spare time. if you have none of that and can't get approval to work on such a report, then ok you need a new job. or maybe a new career.

Re:submit to legal department

[i kan reed]

Well, telling the company about itself isn't going to annoy itself. Telling federal or state officials might, but then... whistle-blower protection laws, suckers(you still secretly get blacklisted).

Re:submit to legal department

[Anonymous Coward]

Well, telling the company about itself isn't going to annoy itself.

Those are the words of someone who has never told a company about itself.

Re:submit to legal department

[v1]

That will only work if the chief legal counsel believes the odds are against them.

Don't forget that an action that saves a few thousand dollars, that has a 10% chance of costing a million, is still a very bad risk, statistically speaking. That risk/loss multiplier is frequently a game-changer. We don''t buy insurance because we think we're going to run into a tree, we buy insurance because we can't afford it if we do - the odds of it happening aren't high, but aren't small enough to be able to ignore, and the loss if it happens is simply too great.

Re:submit to legal department

[mysidia]

Don't forget that an action that saves a few thousand dollars, that has a 10% chance of costing a million, is still a very bad risk

When it comes to security; an action that saves a few thousand dollars, that has a 0.01% chance of costing a million, is still a very bad risk.

Remember.... something that happens 0.01% of the time, is still essentially guaranteed to eventually happen, after approximately 10000 times on average.

To save that few thousand dollars; the risk scenario has to pan out in your favor every time ------- an attacker only has to get lucky once.

Per the law of very large numbers...... statistics is totally stacked against you; with a large enough sample size (attacks, or days); the probability of an attacker getting lucky approaches 100% pretty darn quickly, even if only 0.01% of the time you expect to incur that cost.

Re:submit to legal department

[Anonymous Coward]

Well, telling the company about itself isn't going to annoy itself.

Those are the words of someone who has never told a company about itself.

It's an easy way to tell if a place is worth working for. If they give you shit for pointing out their (correctable, mind you) problems - and the appropriate solution(s) - then why would you want to work there? Unless you're a masochist who enjoys stress, you should get the fuck out while the getting is good. Let them worry about the problems they won't let you fix.

Da fuq?

[Anonymous Coward]

Frequently I do not have control over the code that is deployed; it's simply given to my team by the marketing department.

Well there's your problem.

Re:Da fuq?

[tsa]

He knows what his problem is. Why is your comment rated insightful?

Re:Da fuq?

[Anonymous Coward]

It should be rated "Funny", not "Insightful". It's an Adam Savage (from Mythbusters) reference.

Go on .. tell us who

[OzPeter]

And I guarantee that all your problems will be solved very quickly by the dedicate volunteers who visit this site.

But you may need to brush up your resume first.

Re:Go on .. tell us who

[Drethon]

That use of dedicated and volunteers is 100% accurate given they are both but "dedicated colunteers" and the same people... I think amused best describes my thoughts.

Re:Go on .. tell us who

[nerdblogpl]

Fortune 500 company that has something to do with kids and recently revamped their website? Shouldn't be that hard to find.

Re:Go on .. tell us who

[Anonymous Coward]

CBSNews.com? or FoxNews.com? Both are juvenile and have recently changed their site. I'm going with CBSNews.com, the Fox people seem like the paranoid type.

Re:Go on .. tell us who

[Anonymous Coward]

Now now, the original question specifically said "kids", not "adults acting like kids". There's a difference. Only one group SHOULD know better.

Re:Go on .. tell us who

[lakeland]

The submitted did.

A Fortune 500 company for anyone with kids. That list is about 20 long - it would be very easy to work it out from the submission if you were that way inclined.

Re:Go on .. tell us who

[amicusNYCL]

Well, here's the list:

http://money.cnn.com/magazines/fortune/fortune500/2013/full_list/

They have a website and mobile apps and are a household name for people with kids. Hmm. How about Apple?

Or maybe #66, Walt Disney. Or Time Warner. Or General Mills, or Kellogg. Or Toys R Us. Or GameStop.

Or depending on how much you like having your kids, maybe Las Vegas Sands.

Or depending on how much you liked making your kids, maybe Pfizer.

Re:Go on .. tell us who

[bill_mcgonigle]

Yep, and there's enough information in this description to figure out which one, when correlated with a popular website survey tool that shows that they recently underwent a server platform change. But it's one we're not all too fond of here, so I don't pity the fool who enables them. I am, however, aware of how insanely litigious they are, so it's not worth it for me to call out which company is in violation of COPPA.

If this was a very subtle whistleblowing, then hat's off, I suppose.

Put it in writing

[Anonymous Coward]

Write an email to your manager listing out the security vulnerabilities and your concerns. CC your manager's boss.

Re:Put it in writing

[Anonymous Coward]

^ This. CYA is the name of the game. I used to do security/pen testing/sys admin stuff for a living and I can tell you that I practiced CYA at every turn. Inform everyone that needs to know, copy yourself on all communications and print them for a hard copy (include headers). Speak with anyone above you and lateral that will listen. Make your concerns known or else failure to do this may come back to bite you. Your boss could very well say she asked you to do something about it and make it look like it was you who were guilty of inaction. Seen this happen. More than once. Keep copies of everything.

Re:Put it in writing

[DuckDodgers]

Going around your boss to their boss only makes sense if you have enough solid evidence to get your boss fired. Otherwise, you just took any pretense of a professional or even congenial relationship out back and shot it in the head.

If you're going to report the problems to your boss's boss, I would do it after you resigned - and make sure to include a clear declaration that you are not going to disclose the problems to any third party.

Re:Put it in writing

[gnasher719]

Going around your boss to their boss only makes sense if you have enough solid evidence to get your boss fired. Otherwise, you just took any pretense of a professional or even congenial relationship out back and shot it in the head.

Not necessarily. Your point should be that (a) you have security concerns, (b) your boss has a lot of concerns that he must juggle and his decision is right, (c) you feel of course that it is a shame that security concerns are not addressed, but you fully support your bosses decision. Your bosses boss has his own list of concerns. And he might then think that a website with security concerns is actually _not_ a good idea. So he disagrees with your assessment that your boss is right, he disagrees with your boss, and tells your boss to address these concerns.

Re:Put it in writing

[Anonymous Coward]

You're not "going around your boss" by CC'ing his boss. You're telling him that you're holding him accountable for his [non]decisions. This is essential in healthy working relationships. You're still addressing the email to your manager, showing your respect to his decision, but reminding him that he can screw this up if he doesn't handle it correctly and the shit won't all flow downhill on this one. If his superior has any brains, he'll thank you for the openness (which is what is essential for a proper, operating team). If you had ever worked in management, you'd understand how essential it is to be held accountable, as a manager, to what your underlings are reporting to you.

If I worked for your company, where CC'ing someone higher on the food chain was somehow an offense worth getting terminated over, I don't think I'd be able to handle all the eggshells I was stepping around. When I started working at my current company (which had an extremely toxic relationship between IT and everyone else), I'd involve everyone whose time I figured it was worth to read an email or know a delay was happening. You know what that did? It made everyone in the company think the "new" IT team had some sort of superpowers because we could handle a queue rather than telling everyone "everything A-OK!" until our deadlines are missed at the last minute. Now they're excited about IT; talking about expanding the IT scope and (finally) adding in a programming team just because I include someone from marketing when one of his/her projects is involved. This doesn't go over my manager's head -- it gives him something to talk about with the marketing team in their meetings, opens the dialogue appropriately, sets the proper expectations, and reduces the hostilities that exist when everyone is keeping secrets from one-another. After all, it adds most punch for your manager to say "You keep demanding deadlines about superficial changes, but you can see that the peasants are revolting over these game-breaking issues." when his higher-up is actually seeing the pitchforks and torches.

Re:Put it in writing

[DuckDodgers]

In my experience, bosses that do a very bad job estimating a proper investment in security also tend to react poorly when they perceive their judgment as threatened.

Re:Put it in writing

[DuckDodgers]

I don't mean that you would get fired for it, I mean that there's a fair chance your boss will be embarrassed that his or her superior got the message. Then your boss may not do anything openly bad to you, but take every little opportunity to make your life at the company unpleasant. You might get poorer performance reviews than your work deserves, or find your requests for equipment denied without explanation and then later be blamed for productivity problems you have due to lack of that equipment, or get stuck with all of the least interesting jobs, etc...

A resilient person, whether they're a manager or not, can accept criticism of their decisions and challenges to their decisions with an open mind and humility. They won't take the challenge to their judgement personally, and will instead try to examine the counter argument to make sure there are no factors they overlooked or weighted inappropriately. In my experience, resilient people are uncommon and resilient managers are especially rare (probably because being a manager adds stress). If you find yourself opposed to your manager on something with ethical implications or serious business implications, and you meet the manager in private to express your concerns and are still ignored, my suggestion is to leave.

Legal and Compliance

[Anonymous Coward]

Assuming you are with a large company there should be published legal and compliance policies. You can innocently ask that group for advice about the situation and you will probably find they carry much more weight on what should be done. If they approve of what your manager decided then nothing else for you to do.

Re:Legal and Compliance

[Teun]

Exactly, if this really is an F500 company they must have such, even more so if they also work in Europe.

Call Elbonia

[Chemisor]

There are some newly unemployed hackers in Elbonia, made deaf and blind by viewing Wally's browsing history. Be a good sport and hire a few of them to break into your website. They are cheap and, being deaf and blind, would not be able to actually see anything useful for identity theft, but will sure be able to get your boss to see the light.

Look for another job or live with it

[Anonymous Coward]

are about the only two choices. It's extremely unlikely you'll be able to change anything until the business case makes it something they want to do. Sure you "could" get hacked. What are the odds? The business folk are willing to play those odds. You'll only lose your hair trying to convince them otherwise..

advise & document

[KernelMuncher]

Have a written copy (email) of your exchanges with the boss. Advise him/her of the security risk and what consequences could occur if the software were compromised. If there's no response on the matter forward the communication to the legal department.

It won't be a problem until it's a problem...

[Anonymous Coward]

...then it will be your problem no matter how well you perform due diligence in this case. This is why I'm making it a rule that if I have to be responsible for making decisions, I want irebokable severance going forward so I can do the right thing by the stockholders without fear of retaliation due to butt-hurt bosses...

Re:It won't be a problem until it's a problem...

[Anonymous Coward]

irebokable severance

Severance that can't be...given Reebok shoes?

Re:It won't be a problem until it's a problem...

[epe]

Leave, ASAP.. quit:
it is a problem of ethics.. don't work in an environement that does not adjust to your ethics. That's it.

Re:It won't be a problem until it's a problem...

[Frobnicator]

No need to leave over that corporate decision. It is likely to only be a problem if you make it one.

If you are afraid you can CYA with a printed paper trail showing their responses, and then do the job you are paid for.

The company bought the software, they did the risk management, and they decided to use it. It is improbable that a developer would be fired over security problems for the platform that was brought in externally. You found some security bugs and were told not to fix them in this release. Good enough, get QA to mark them as "known shippable" or "deferred" and move on to the next bug.

For all you that may even be THE ENTIRE REASON the fortune 500 company bought the product to begin with; they can disclaim liability because someone else made the system.

You reported some bugs. They are choosing not to fix those bugs. This is normal in software development. Some bugs get fixed, some bugs ship. This is daily life.

If you spend your time bringing up security problems and going over your manager's head, following that route will quickly lead to the unemployment lines. Just carry on with your job; some bugs are not getting fixed in this release, nothing else to see here.

Marketing!?

[Anonymous Coward]

I'll address these concerns you have one by one:

* If there's any failure, willful or not, by your company to comply with any laws you should notify legal immediately. They'll appreciate that.

* You receive your code from marketing!? I hope I read that wrong.

* If your job is to deploy code, you have a duty to refuse to deploy code until such fixes are put in place. If your boss overrides that decision, speak with someone higher up the chain. If push comes to shove, document the security issues and your thoughts to protect yourself.

* If you feel you cannot perform the job you were hired into, you should find a new job. It sounds like you can't if no one is listening to you.

Re:Marketing!?

[Anonymous Coward]

To summarize, there is no upside here. Comply and take your chances, or run as quietly and anonymously as possible for your life.

risky but very useful

[fluffythedestroyer]

I often found that when someone doesn't want to listen to you and you know what you have to say is important, then the solution to it is create more noise until your heard.

In your case, which would be very risky as you "could" lose your job but at this point I would do it since no one wants to listen, its to create a problem LIVE and let the company go in nightmare mode.

To be more precise, let them think a hacker got all the info off of one of the vulnerable issues and because of that they got some sensitive information..just don't let them know its not true. Let them think it's real and let them freak out a bit.

Then, after they freak out, calm them down and explain how to fix it...at that point, they will listen and undertand your issue...some people are just plain fucking idiots. That especially happens on the higher end of a company, its like they live on another planet and only looks at numbers and statistics only.

Re:risky but very useful

[Anonymous Coward]

create a problem LIVE and let the company go in nightmare mode.

I'm pretty sure that what you are describing is neither legal nor ethical.

Re:risky but very useful

[PaddyM]

This is a terrible idea. I strongly oppose this approach.

Re:risky but very useful

[Anonymous Coward]

A pretend zero-day "it was all a serious joke" approach is a terrible idea. Nobody will take it well.

Better: Hack your own app with some common technique, document how, tell what skill level a random hacker needs to do that, show some of the live data you actually get out of it, describe what impact this may have on your customers, and show how much financial impact similar breaches have had on other companies. Give a rough estimate of the number of this or other types of vulnerabilities your software has been accumulating. Describe what some of those other vulnerabilities may be.

Put it all in a very brief presentation or document whose responses should be "I had no idea they could do that" and "It will cost us how much?"

Re:risky but very useful

[Nefarious Wheel]

That will be a truly great conversation starter in prison.

Re:risky but very useful

[Anonymous Coward]

Should be, but at a Fortune 500 consumer products company the responses may be "Who else knows about this?" and "Here's the exit. Remember you're under NDA - tell anyone else about this, and we'll own everything you have now and everything you might ever earn in the future." instead.

  OP needs to be prepared for that.

Re:risky but very useful

[fluffythedestroyer]

Not really as the people who takes decisions ignored it. the workers under did say and did everything he could. That person has nothing to do with it... besides, you can call it a prank as everything would be a maskarade..if you read my post carefully

Re:risky but very useful

[Anonymous Coward]

Better: Hack your own app with some common technique, document how, tell what skill level a random hacker needs to do that, show some of the live data you actually get out of it, describe what impact this may have on your customers, and show how much financial impact similar breaches have had on other companies. Give a rough estimate of the number of this or other types of vulnerabilities your software has been accumulating. Describe what some of those other vulnerabilities may be.

Put it all in a very brief presentation or document whose responses should be "I had no idea they could do that" and "It will cost us how much?"

Yet the actual response will be, "Well why didn't you fix the problem instead of dicking around and hacking OUR servers? You're fired, and you'll be hearing from our legal department!" Then again, anyone who actually comes to Slashdot with an article asking for advice has some deep issues anyways. Maybe it'll be for the best.

Don't do anything if you have kids.

[musixman]

Does it ever work out well for the whistle blower? Document your concerns then move on... it's better then being unemployed.

Re:Don't do anything if you have kids.

[gtall]

I'd vote for moving on. Companies can be quite vindictive and screw you over with any future employers. They have even been known to sue whistle-blowers.

Don't ask /.

[Dishwasha]

I'd start by not advertising to a large public forum containing a lot of people with security exploit experience and motive about your companies web security vulnerabilities where your synopsis easily reduces the attack vector to significantly less than 500 potential targets. How many fortune 500 companies exist that target kids, let alone ones that have a female web software development manager? Also, it should be fairly easy for somebody in the industry to discover which fortune 500 kid targeted companies outsource their system administration.

At this point, I would do nothing. If they aren't hacked within a week after you posting this article then the security vulnerabilities don't really matter.

Re:Don't ask /.

[paavo512]

At this point, I would do nothing. If they aren't hacked within a week after you posting this article then the security vulnerabilities don't really matter.

Maybe this was the strategy of OP? In that case, brilliant!

Re:Don't ask /.

[Anonymous Coward]

... let alone ones that have a female web software development manager.

In the F500, that is not going to narrow it down - I can guarantee you that all of them have at least one female development manager, and probably many more.

For my stereotype of the day: I'm going to guess that you are over 50 years old.

Re:Don't ask /.

[Anonymous Coward]

So it's CBS, VIACOM or Mattel.

Re:Don't ask /.

[jonpublic]

So Disney?

Re:Don't ask /.

[Dishwasha]

If that was the OP's strategy, then (his|her) brilliance is inversely proportional to the terms of the NDA s?he may have signed on employment.

Re:Don't ask /.

[Anonymous Coward]

Totally Mattel. Quick google search for news pointed me in that direction. OP is retarded for providing enough info to single it out. Basically painted a target on himself. Maybe hes doing it on purpose though. Carrer wise, it looks pretty good when you have been complaining about security and then you get popped.

Re:Don't ask /.

[MountainLogic]

Hey, Bob, is that you who posted this article?

Re:Don't ask /.

[Anonymous Coward]

Weak targets are already know to hackers / crackers.

Re:Don't ask /.

[Anonymous Coward]

Good advice, because nobody is currently targeting the F500. Now, they can't just slip under the radar.

Paper trail

[bugnuts]

Plain and simple, keep your old emails, offline. If you get cornered for a conversation in person or phone, no problem... just dash off an email stating "You know how you were telling me at lunch not to worry about the security vulns? This still really bothers me. There's got to be a way to mitigate it without affecting deadlines. Imagine the missed deadlines if we lose our infrastructure to an easy hack."

Don't sound like a troublemaker, but rather, a concerned worker.

Make it clear you're the professional, and in your professional opinion and that of industry standards, security is sorely lacking. Itemize the issues you have in an email. Keep that email.

Support their decisions, and live with it.

Finally, if the shit hits the fan and anyone points fingers at you, refer them to that email. If they fire you for it, that's when you become a troublemaker.

Re:Paper trail

[Anonymous Coward]

Sounds like in your company, the noisy wheel get replaced, not fixed. Get your resume in order before your going raising the issues. It's obvious managements priorities are updating the website no matter what, sort of like Obamacare's website. Eventually something will happen and your'll be the scapegoat.

Re:Paper trail

[Anonymous Coward]

They won't fire him for that, they'll fire him for something else unrelated. His bosses clearly don't want "concerned worker" they want quiet obedience, and he's already failed at that, or maybe a sacrificial goat. He needs to start looking for a new job.

Relax, we understand j00

[Anonymous Coward]

Go home, drink a bottle of whiskey, cry a little, go to work the next day and stop worrying about it :)

Cover your own arse.

[TechyImmigrant]

Cover your own arse. Document that you were the one reporting the problems and violations. You may lose your job anyway. Prepare for alternative employment. This is always easier while you are still employed. Once you have a reasonable plan for alternative employment you can start making demands. You may either be the hero, or you may end up in the other job.

Re:Cover your own arse.

[mrbester]

Get documentation. Get a new job. Get them in the shit.

You've tried many times already to alert them to problems and the fact that there is illegality involved means they don't give a fuck. So why should you?

Up to you

[Drethon]

To me it is all based on what your own conscious demands. I spent years battling with my employers about their testing methods (the solution to the program crashing is the user should never enter that combination of values... yet you aren't going to prevent them from doing just that?) and got nowhere. At this point I put in my 40 a week, document the rejection of my recommendations (e-mail archives are your friend) and take pride in what I do outside of work.

If your conscious wont allow for that... ask someone else.

Re:Up to you

[Anonymous Coward]

Never ignore your conscience if you're conscious!

Re:Up to you

[rossz]

I had a similar experience many years ago. The very first test I did with every build was press both hands on a bunch of keys. It almost always locked the system up completely. So I'd reject it. The lead programmer (who as an idiot) kept saying, "don't do that." My response was, "that's a cat jumping on the keyboard, or a tired person accidentally leaning on the keyboard. It's something that will happen. And when it does, it locks the system so tight you have to do a hard reboot." BTW, this was back in MSDOS days.

One day he told me my job as QA wasn't to QA the program (like I said, he was an idiot). So I said, fine, and quit on the spot. I don't do QA now. I hated it. Now I'm a system admin.

Re:Up to you

[Drethon]

Bah, after a 10 hour day I have the energy to spell check, not grammar check ;p

Approach the CHAIRMAN not the CEO

[Bruce66423]

It's his responsibility to protect the company from idiots. Alternatively speak to the auditors, who also have a duty to report concerns. But on the whole you are probably screwed; whistle blowers tend to be shot on principle even if they have done the right thing - a new job is probably the best solution.

Re:Approach the CHAIRMAN not the CEO

[mrbester]

*His responsibility*? Fuck that noise. He tried already. They don't care. Fuck them. He owes them nothing.

Re:Approach the CHAIRMAN not the CEO

[Bruce66423]

The responsibility of the Chairman, not the development manager. But yes, he's tried very hard to avoid a hard landing; if I was him I'd be looking for a new job.

Impossible.

[Anonymous Coward]

I've been told repeatedly here on slashdot and elsewhere that private companies, especially big ones, don't have IT problems, only the goverment does because everything the goverment does is terrible while everything the private sector does is perfect. So either you are lying or they are wrong.

Outsourcing

[K. S. Kyosuke]

However it's a security nightmare for sysadmins (which is all outsourced)

So it is the security nightmare that is outsourced? Finally someone got outsourcing right.

Prove It

[Jah-Wren Ryel]

Can you get budget to hire a security penetration tester? There are companies which will do penetration testing and then give you a report documenting all of the vulnerabilities they found. With that in hand you have a much stronger case to convince management to fix the problem because now it is a highly qualified security expert that has documented explicit problems.

Re:Prove It

[u38cg]

A lot of pen-tester companies will do some initial work for free. At my work, the company who was asked to present to the responsible committee went round each person and handed out a little slip of paper - with their password on. They got retained.

Re: Prove It

[Anonymous Coward]

Yup.

Odds are, the vulnerabilities the op knows about are a drop in the ocean and even if they fix all of those, it will still be trivial for a pro to hack.

Re:Prove It

[Anonymous Coward]

I must second this. Do the professional thing: Obviously the company is not all clueless, after all they hired a security conscientious Senior Engineer and Software Architect (YOU) to oversee and follow up on how things go. Just ask yourself what are you bringing to the table. Based on your post, I imagine that the answer might be something along these lines: I know this and that about information security and COPPA and I see that we have less than ideal outsourcing mode wrt. information security and the associated exposure to risk of brand damage.

Since you asked what would I do, I'd find the person who's job is to manage security and/or PR risks, let him/her know about the concerns and cooperate to prepare a useful proposal about commissioning an IT security company to audit the information security of the website and related software process and critically asses the risks, including the business impact of various potential incidents. That should give you, the person responsible for risk management and ultimately your boss a good idea of how much effort should be put to improving the practices that contribute to the risks. There shouldn't be any good reason to engage in a blame game with your boss or the marketing department overriding you, I'd just try to put my ego aside for a while and remember that there are various levels of understanding of information security risks and their impact, and your average marketing manager might not have the educational background to make informed choices about how much to invest in security and other quality factors versus the development of new features. Again, that's probably one of the main reasons they hired you, so just do your job, professionally and modestly, talking to the right people and not going all pointy fingers lest you wish one end up pointing at you. Do your homework and proceed to educate people making the decisions.

Another thing - you must not be the only SW person in the company, find another IT guy who's already done some time looking at the ominous clouds of uncontrolled outsourcing clutter the once clear blue sky and begin to shadow the spring fields where happy in-house hackers used to craft software that shone on to your customers the love that was put to writing it. Talk to that person, try to find out what has already been done about the problem and whether there is maybe some underlying organizational disfunction at the root cause of the mess you were brought in to patch up. Sometimes in large organizations things that appear absurd (in your case blatant? disregard of security risks) indeed are badly wrong, but not because someone (anyone telling you deadlines are more important) just doesn't get it, or any other immediately obvious reason - the actual cause could be something that only people closer to the source of the problem are aware of and with a high probability related to interpersonal dynamics somewhere in the organization. Maybe your boss has tried to escalate the concerns and gotten dismissed, so try serving him/her some coffee to check that you have a good understanding of his/her point of view.

Last but not least, don't get overly anxious about your situation - Senior Engineers intuitively know that there have been generations of Senior Engineers facing similar problems before them and that there will be generations and generations to come, of future Senior Engineers facing similar problems, after they themselves have finally been promoted to Principal Engineers to figure out problems with ever thicker hair, higher risks and worse underlying organizational mess at their cause.

Re:Prove It

[Anonymous Coward]

Brilliant!

Re:Prove It

[Anonymous Coward]

Sounds like _black mail_

How serious is it really?

[Khashishi]

So let's say it gets hacked. Are we talking minor embarrassment, or serious privacy violations? All big companies patch stuff all the time, after they deploy. Adobe probably has a big list of things that need fixing when they get around to it, which maybe explains why there are constantly updates.

Re:How serious is it really?

[gl4ss]

well lawsuits and all that jazz if it gets hacked or known which company it is, since they're technically breaking the law by having the data stored so.

Cover yourself first

[Anonymous Coward]

When a hacker eventually steals and publishes all the little kids' info, are you the one who will get blamed? If you are, then find a new job now.

Integrity Hotline

[MNNorske]

If you're working for a Fortune 500 company there likely will be some form of internal integrity hotline. I know my own corporation has one. Document your concerns and contact them. I recently had to report a concern raised about one of the major offshore contractors we use to our integrity hotline and it was actually a very good experience from my side. After submitting the issue it took a few days but an investigator from our legal department contacted me and we had a phone conversation, and then I forwarded him some additional details I had held back from the initial correspondence. I did that mostly to protect an individual from the contractor who brought the concerns to my attention.

I would make sure that the correspondence you send to your legal department includes copies of some of the email chains you have with your managers, peers, etc... raising the concerns. Be sure to specify any regulations you suspect are being violated. If the legal team determines there is concern you can bet that change will happen. If they determine otherwise, then you've done your due diligence and reported it within the means your company gives for you to report it.

Re:Integrity Hotline

[Anonymous Coward]

Any publicly traded company is required to have this, as well as allowing for anonymous reporting as well.

Re:Integrity Hotline

[nameer]

In general, if you absolutely know that you are in the right, don't report anonymously. If you report as yourself you have protection against retaliation. If you report anonymously, those protections go away because the ethics/integrity dept can't show that there is retaliation without knowing that it was you that reported the misconduct.

Re:Integrity Hotline

[Anonymous Coward]

If you report as yourself you have protection against retaliation.

In theory, and legally, thats true. But we've seen that it doesnt quite seem to hold true in reality, with no consequences for the criminals.

4chan

[Anonymous Coward]

Get numerous written reports with security concerns and documentation. Get written notice from your superiors to make no changes. Leak some information to 4chan.

Eat popcorn.

Re:4chan

[Anonymous Coward]

Don't leak it on /v/ or /g/, we have enough trouble staying on topic as it is.

File it under NYP

[Anonymous Coward]

Not your problem.

Take your money and run to the ... sofa.

Been there

[Anonymous Coward]

I did the smart thing; put my paper on the street (immediately) and started searching for a better, smarter, place to work (and found it). When shops abandon all the lessons and experience learned over decades of maturing our industry; It is unlikely to matter. "Agile" has been and is often used as an abomination to do a way with pesky issues such as quality control, proper coding, release strategies, and requirements (dont be haters, Agile used correctly is a powerful tool for rapid development). Turning everything into a "beta" product that is ripe for failure and abuse and releasing it to the public, and the burden of the results or responsibility will not fall on the shoulders of those who made that decision. Thats why they made it. Since your in a Fortune 500, I would look for greener pastures inside as well as talk with a few 'good/effective' recruiters.

Do the right thing for yourself

[Anonymous Coward]

If your company is breaking the law you should report it to your legal department via email AFTER discussing it with your manager and cc him and his boss. Alternatively visit your HR representative, who's job it is to protect the company, not watch out for you, and discuss it with them. If you do not, one day the hammer will come down and you will be thrown beneath it in the interests of mitigating damage to the company. If they decide to hammer you for reporting the issue then its not a company you should work for is it?

Or you can give notice and explain your reasons for leaving at the exit interview.

Re:Do the right thing for yourself

[Anonymous Coward]

"Or you can give notice and explain your reasons for leaving at the exit interview."

Or not. I left my last job because they would not fix obvious personnel problems. I was doing my job and that of another who was never at work. I was told to just "suck it up and do the work". I left. They demanded an exit interview, and I refused to tell them anything I thought was wrong - my explanation was "you would not listen to my concerns while I was employed, you don't get to hear it now. You had your chance".

Talk to an attorney.

[Anonymous Coward]

You should get advice from an attorney. You COULD be held responsible if something happens. Do you think your boss would stand by you and say you did your job, but she told you to wait?

Prosicutors would pin it on you because you failed to report it, and those truely guilty would use you as a scapegoat. Be smart, talk to an attorney, then at the very least you need hard evidence that you went to your boss, several times, and even over her head. If you have plausable deniability, then you are mostly covered.

Watch your p's and q's. dot your i's and cross your t's.

Rule #1 of business

[Anonymous Coward]

Credit travels up, blame travels down. Make sure you are up and out before it happens.

hate to say it BUT...

[Anonymous Coward]

that's pretty much what I did for several years... (well, that & pay off our house so it wouldn't matter that much if I got blamed)

I even coined a Dilbert-esqe term for it: "the rapt* principle - no cube dweller ever got rewarded for being right about someone in a corner office being wrong..."

*long story I'll spare everyone

it's definitely the corporate Kobayashi Maru...

that said (& as others have noted): DOCUMENT! DOCUMENT! DOCUMENT! it won't save you from corporate scape goatting but could from a legal/PR/future job hunt problem...

how much money can be lost?

[alen]

what's the worst thing that can happen if the site is hacked? any CC info? how much money will be lost

not every site and data should be treated like fort knox. keep your emails for CYA purposes and keep doing what you are doing

Re:how much money can be lost?

[sconeu]

Jail is the worst that can happen. Remember, he said "COPPA". That's a federal law regulating how websites deal with children.

Whitepaper

[Spazmania]

I wrote a memo laying out all the issues in layman's terms and proposing solutions. Then I gave it to my boss. A little while later with no further movement on the problem, I quit.

A year passed and the system was hacked. Publicly. Embarrassingly. Folks here on Slashdot asked what the sysadmins could possibly have been thinking. So, I published a copy of the memo I had written.

Your mileage may vary.

Re:Whitepaper

[DogDude]

So you lost a job AND put yourself in legal jeopardy? Somehow I don't think that was the best way to handle your problem...

Like the previous article...

[Anonymous Coward]

move on to a company that knows what they're doing.

Contact your companies Compliance Officer

[Anonymous Coward]

A fortune 500 company that deals with any area that has Federal compliance laws like COPPA, HIPPA, etc should have a compliance officer. They would be the person to contact for issues like this and contacting them should address all your issues.

1) It gives a paper trail showing you raised the issue and should prevent you from being the scape goat when something happens.

2) It should give you someone who understands the relative compliance laws and the risks associated with not complying.

3) The compliance officer should then have the juice to get something done if they determine this is a legitimate issue. If they determine it isn't an issue then their neck is on the line not yours.

Re:Contact your companies Compliance Officer

[TubeSteak]

3) The compliance officer should then have the juice to get something done if they determine this is a legitimate issue. If they determine it isn't an issue then their neck is on the line not yours.

The submitter doesn't just want to cover their ass, they want to do a good job.
It's endlessly frustrating when it seems like your boss or co-workers are conspiring to keep you from doing the best work that you can.

This happened to me. Please read the following

[Anonymous Coward]

This happened to me when I was contracting for the USDA. Developers were pulling SQL statements in url strings. No... I'm not kidding. Literally "SELECT * FROM .

1) keep a copy of every email you sent.
2) evaluate the situation from an objective point of view. Should security be breached... what would be the possible fallout?

If personal information loss is part of this, immediately take your concerns to your legal team. In my case, I was told by several individuals it was not a problem and it was safe followed by my supervisor who told me it would be fine. I was okay with it until I realized I could pull anyone private information this way including social security numbers.

The legal team was very easy to work with. We had to self report 56 violations and my supervisor and two developers were terminated.

In this case I follow my uncle's advice

[NotSoHeavyD3]

He's of the opinion that you give your opinion once. If they choose not to listen to you well fuck them. (Admittedly my uncle is very smart, has an ivy league degree. Anybody that ignores his advice is royal fucked.) I'm guessing the best thing to do is start looking for a new job because some how I doubt they'll suddenly get smart. (They'll probably just manage the company into the ground and then blame you for it.)

A union would be helpful in this situation

[Goonie]

While trade/labor unions are much maligned in the often libertarian-leaning IT community, this is the kind of situation where a bit of organization amongst colleagues - along the lines of what engineers or medical professionals have, would actually be useful.

But given that we have the IT professional community that we have:

• Document that you've told your boss, and probably your boss's boss, and probably the legal department (perhaps informally and verbally initially). If you've told them, it's their problem, not yours
• Start polishing your resume. Whistleblowing usually has negative consequences for the whistleblower - and, furthermore, continuing to work for an organization which has such a lax attitude to software poses a risk to your career if you stay there.

Incidentally, your case neatly demonstrates the near-uselessness of the IEEE-ACM Software Engineering Code of Ethics, which is very long on what the ethical obligations of a software engineer are, but has nothing useful to say about what you should do where others are ordering you to act unethically.

Re:A union would be helpful in this situation

[Anonymous Coward]

Incidentally, your case neatly demonstrates the near-uselessness of the IEEE-ACM Software Engineering Code of Ethics [computer.org], which is very long on what the ethical obligations of a software engineer are, but has nothing useful to say about what you should do where others are ordering you to act unethically.

I always thought it was pretty clear. If someone is ordering you to be unethical, don't. Easier said than done yes. Doctors make enough money to easily move on when asked to violate their code of ethics. With engineers it's not so simple. I found myself in a similar situation a few years ago at a startup. My solution was to form a release process that didn't rquire my signature, but did require the signatures of several directors and a VP. I convinced them that the act of releasing software resulted in a company expense high enough to warrant such measures. I still didn't like it, but I didn't release crap without going through days of explaining to management how much money it was going to cost to deploy crap and to get their express written approval to do so..

Re:A union would be helpful in this situation

[Anonymous Coward]

1.03. Approve software only if they
have a well-founded belief that it
is safe, meets specifications, passes
appropriate tests, and does not
diminish quality of life, diminish
privacy, or harm the environment.
The ultimate effect of the work
should be to the public good.

Let the stockholders deal with it

[Anonymous Coward]

I suggest you anonymously post the issues to some very public place.
The stockholders should deal with it, due to the huge liability issues.

Think of it as banking overtime

[SuperCharlie]

Sure send your notification emails and cya.. once that's done it's more a game of wait for the overtime, because when, and I mean when, it goes down it will be like Oprah came by with.. And overtime for you, and for you, and for you.. overtime for everyone until we fix this!!

Explain clearly how easy it is to breach

[Beeftopia]

Step by step, so a non-technical type can understand just what the issue is. "Security" for some folks is a vague amorphous issue with no real consequence. I've been stunned by some of the malware and lack of security I've seen on people's computers. They don't "get it." They don't understand the risk and the damage.

Help your boss "get it" if that's the issue. Explain the consequences of a breach, and the damage to the brand. Show with other examples in the media.

My $0.02.

Give up...

[Anonymous Coward]

Give up and come work for me.

Your first job will be to make a couple of security attacks on your old company.

I have a couple of million I can use to short those idiots....

Document, do nothing

[onyxruby]

Document the issues so that it is clear you are aware and tried to do something about them. Bring them up verbally to your boss - without being obnoxious about it. Once you've done those than you need to the hardest thing of all which is to let it go. If you make too big of a deal about it you will be seen as a troublemaker. If you do nothing you will be seen as complicit or incompetent if there is a violation.

Now in certain industries you may have requirements (possibly enforced by law) that require you do to more. Most of the time that isn't the case and you have to let it go and move on with other things. Often times disasters are the only way that people higher up the food chain can and will learn.

I recall when Nimda was making it's rounds in 2000. I was aware of the worm, had the patches downloaded, instructions printed and had requested permission to patch servers. Permission was denied. I asked again, it was denied again. I had awareness of the issue, my statement of the severity and denial all in writing.

I watched a fortune 25 company go down for 2 days and lose $100 million dollars and countless workers get sent home when their facilities were rendered useless. As a result an inflexible policy was changed and any number of people were fired or disciplined. Because I had documented everything I was just about the one person nobody faulted.

Re:Document, do nothing

[david_thornley]

As far as legal liability goes, you should be able to get a short low-cost consultation with an attorney through the local Bar Association, or (since you're in a Fortune 500 company) possibly an Employee Assistance Plan. The time and money are likely to be well spent if you are worried you might be in legal trouble. Either you'll feel a lot better about your personal situation, or you'll know better what to do.

Do the right thing

[Anonymous Coward]

#1: Document every security problem you find and rank them in severity as far as how much they'd hurt the business if they were exploited. Document steps to exploit them from the outside if you know how, or if only exploitable from the inside, document how that could be done too.
#2: Notify appropriate management of all these documented issues, particularly the ones most damaging to the business that would be easy to exploit from outside.
#3: Explain the consequences if the exploit occurs. It might not be a bad idea to find news stories of other organizations that have been compromised to show the fallout from such problems.
#4: Document steps to rectify the exploits if you know how to, in as much detail as you can and preferably with time estimates.
#5: If all of this falls on deaf ears, go higher up. Find another job before doing so (at least get an offer) if you believe you will receive backlash for going above management's head. Honestly if the management above your manager is competent, they will greatly appreciate your efforts.
#6: You can also publish this list to any communally-accessible location and send it to all the developers in your company who are creating software that has security holes or could have them. Knowledge is power and I doubt all your engineers know they're creating dangerous security problems.
#7: Do what you can with the code you control. Lock down and secure whatever is most important. Let the small problems slide if it means the big ones get plugged. This is why the severity ranking is important, to help you and others prioritize.
#8: You should also log all these issues as defects and assign them to the appropriate person/team as ship-stopping defects, so that the software CAN'T be released until they're fixed. At least, that's how it works in a healthy development shop (which it sounds like you're not part of at the present time).

Wild guess

[hcs_$reboot]

Your company is Sony?

Drop the dime

[g0bshiTe]

If it's dealing with children and you are that concerned and management has done nothing to change it, blow the whistle on them.

Who is the business owner of the app?

[macbeth66]

You should include the business owner on your emails to your boss outlining what is wrong AND how to fix the problem. Include in the what is wrong part, why the app is vulnerable.

Since you state that you came into the migration towards the end of the process, state that you are just now understanding that these issues even exist.

Is it...

[rhazz]

Webkinz?

Re:Is it...

[Anonymous Coward]

Busted...

Re:Is it...

[Anonymous Coward]

Disney or Mattel, they are both fortune 500

Re:Is it...

[Anonymous Coward]

Toys r us?

Re:B'OH!

[geminidomino]

He said CC and he meant it. Part of the logic (he even said it explicitly) is that the boss sees "Oh crap, now all these other people in the company know what's going on, and will be watching to see what I do about it."

signs

[DriveDog]

Difficult to imagine the powers that be caring much about application security if they're willing to outsource sysadmin duties. And yes, I know that's common. But that doesn't make it sensible from a risk management viewpoint.

On the technical side

[Beryllium Sphere(tm)]

So you've got a vulnerable web app that can't be fixed with new vulnerabilities being introduced all the time.

That's what web application firewalls are designed for. Installing one takes less schedule time than doing things right would take, and it might work better than nothing.

Though of course this is not a technical problem, it's easier to paper over a people problem with a technical patch than it is to fix people.

Escape!

[Bugler412]

Document the problems, report them up your chain appropriately and thoroughly, backup that documentation to personal storage resources to CYA and get out of there before the inevitable implosion happens. The management shakeup that will occur during and after the implosion will sweep away people regardless of who was aware of it and reporting it properly. The CYA is in case there are legal repercussions which draw you in,

or to put it another way

[frovingslosh]

Or to put it another way, nothing will get fixed as long as the software architect is as gutless as his management and just posts as an anonymous coward and helps conceal the problem. Sure, you don't have to commit carer suicide by saying "I'm the guy in the third office on the east wall and I've been reporting all of these problems to Bob but he just lets them slide, here's how to hack our toys", but you could put minimal effort into letting the problems slip out and help the public become aware of them. The hackers likely know about them anyway, management has decided that they don't care, as long as the public doesn't know. When the public knows they will become interested in fixing it.

Re:or to put it another way

[Anonymous Coward]

you could put minimal effort into letting the problems slip out and help the public become aware of them

So a front-page post on /. that all but identifies the offending company is not minimal effort? Personally I think the OP is playing his cards very well.

Re:or to put it another way

[Anonymous Coward]

I don't think this is cowardly at all. He clearly plans on doing something, and is asking for advice. Inviting people he doesn't know or trust to do as they will with the system is not ethical, brave, or anything but stupid.

DO IT AND KEEP THE EMAILS.

[Anonymous Coward]

CLIENT: 'Let's email credit card details from our SSL website to lots of different locations'

When I said Uhh nooooo, I was unhelpful and not at all a celtic tiger and another company ended up doing all the transaction work. I don't work with them anymore.

Walk

[Anonymous Coward]

I could literally walk into any internet cafe anywhere in the world and with a one line SQL injection attack put my last employer (also a well known publicly quoted company) out of business within 24 hours. I documented the attack, I documented several different ways to fix it. Senior management were not interested, they just wanted new features.

Walk. Get a new job before the ceiling caves in.

You don't want to apply for a job and have the hirer glance down your CV and see you worked for that corporation that just went so messily bankrupt.

Risk Cost Assessment

[cryptomancer]

Probably the task furthest from experience as an engineer/architect, but when it's not enough to tell them (boss, executives, legal) that it's a "potentially bad thing," also include some dollar figures.

As a tangent, you should also always have the right to contact Legal without supervision. In this case, you could even tell that person in the legal department you're doing a risk-impact report (without lying) and need an estimate for how much it would cost for the company to legally defend or settle a class-action violation of those COPPA guidelines/regulations. Because that suddenly becomes the development budget for making sure everything is in compliance.

Re:Risk Cost Assessment

[LeadSongDog]

That's getting close. Talk to your auditors too. Let them figure out what the liability is, and they'll persuade the board to take action. Meanwhile, get your incident response plan ready. Once the intrusions start, you'll have a lot of people breathing down your neck looking to know how to respond.
Insert obligatory "Think of the children!!!!" where needed.

Hmmm....

[Anonymous Coward]

Fortune 500 company? Mattel perhaps?

Self-Righteous

[Anonymous Coward]

I find it hard to swallow a question like this.

Security is a tradeoff between the amount of time/money available, and the the features/productivity required to keep the company afloat and paying your salary (Surely everyone on /. is aware that security is a continuum with many shades of gray, right??)

Mangers (i.e. NOT YOU) are paid to figure out where that tradeoff is, and ensure that the company continues to make money so that everyone gets a paycheck and there are not mass layoffs. Yet....somehow....it seems like there's always some low level twit like you who believes he knows where the "CORRECT" tradeoff is, and nobody else could possibly have a differing viewpoint with validity.

You voiced your opinion - your opinion was not accepted. Move on and accept the fact that this is a business decision made by managers - i.e. NOT YOU.

Re:Self-Righteous

[Anonymous Coward]

Buzzword bingo..

SENIOR engineer (ie., OLD, cannot master runtimes like JRE... .Net...)... check!
Fortune 500 company (more money than he has)... check!
Brand (more fame than he has)... check!
Household name... check!
Brought in towards the end (Janitor)... check!
COPPA (is that some sort of COBOL extension?)... check!

Should I look for a new job (yes... as ... something I am sure).. check!

Ironically the capatha for this post was TRUMPET! ... check!

Re:Self-Righteous

[Cederic]

It's interesting that you're trusting that the manager's assessment is accurate, but the expert's assessment is self-righteousness.

This will be why most of the responses on here are recommending getting additional opinions, primarily from the people employed by the company to assess legal/compliance risks and the appropriate responses to them.

The question isn't saying, "my manager is wrong, she's acting like a cock", the question is saying, "I disagree with my manager about the severity of these issues. How do I assure that these issues are not putting the company (and me) into jeopardy?"

That's not self righteous, that's professional.

Take it to your CSO

[Anonymous Coward]

You're at a Fortune 500 company, right? So you have a Chief Security Officer. Take it them, highlighting your bosses brushing aside of serious security concerns.

Policy and Procedure

[Anonymous Coward]

Your company has P&P in place for a reason, follow it rather than asking Slashdot what to do.

I'd look around

[ComradeF]

That "gotta meet the deadline at all costs!" attitude is probably coming from the top down... going over your boss' head would be yield nothing but anger from above, and you'd be branded not as someone trying to do the right thing, but as a troublemaker. Can almost guarantee it. If your employer is so obsessed with doing it quickly as opposed to doing it correctly, and you're obviously of a different mindset, you need to look for new opportunities. Let them deal with the blow-ups while you give your talent to another company, one who'll appreciate your attention to security. That's how the market is supposed to work, in theory...

Re:B'OH!

[danomac]

Here I thought we was using his Credit Card.

Not surprising...

[Anonymous Coward]

They'll understand the consequences soon enough. Its the same with other companies as well.

Ombudsman.

[luciano.moretti]

You're at a Fortune 500 company.

Document issues, why they are regulatory violations, document that your raised them to your boss and got pushback (agree with the "offsite hardcopy" backup).
Then call the Ombudsman and raise the concern to them. That's what they are there for- Issues where the company itself could be screwed by individuals trying to make numbers any way possible.

Don't

[Ancient_Hacker]

Don't even think of "helping".

I have tried doing just that, at least 3 times. It's never appreciated by mgmt. They either already know, or have been actively avoiding learning about these problems, or are unwilling to spend money on it. They will either frown, deny your facts, not follow up on your suggestions, or just plain fire you for not being a team player. Been there, tried to "help", got canned twice, now I don't squawk about the SQL injection issues, phishing, spam, etc, etc, etc.

Just start looking for another job, with luck, at a less clueless place.

Marketing department is supplying the code?

[Anonymous Coward]

"Frequently I do not have control over the code that is deployed; it's simply given to my team by the marketing department."

If this hasn't prompted the answer "run as fast as your legs will carry you" then asking slashdot is not going to be of any use to you whatsoever.

Sometimes I think these Ask Slashdot stories just get made up by the editors when they're bored to see what replies come in, and the above quoted sentence is a particularly good piece of evidence for this.

Re:B'OH!

[Anonymous Coward]

Here I thought we was using his Credit Card.

In that case he could just sic a PCI compliance audit team on them.

Read this study and make your own analogy

[paiute]

http://www.newsday.com/news/health/gut-feelings-might-be-best-predictors-of-marital-bliss-1.6512381

Tell infosec.

[HockeyPuck]

Surely there's a infosec or security group at your company. Let them know. Otherwise, fire a note to your boss and cc'd your second level manager.

Don't have the email be one where you are blaming your boss, but if the security issues are beyond your manager's command and control span, then it's probably under your next level manager/director. Something as simple as "I've noticed some odd security practices taking place within the application... what group is responsible for setting the methodology...?"

Sounds harmless but gets the point across.

Re:Tell infosec.

[Anonymous Coward]

This.

The key to effective emails/memos/etc in circumstances like this is to NOT make them confrontational at all. Ask for information. Give your manager(s) a way to respond without going on the defensive. ("Maybe I'm misunderstanding the situation, but [xyz] looks like a potential security breach that could expose $COMPANY to liability under COPPA. Could you explain why it's not or, if it is, suggest what we do about it?")

You want management (possibly higher management than your own) to focus on fixing the problem, not circling the wagons against an insubordinate employee. If you're CC'ing your boss's boss, or other departments (legal, security, etc), which you should be, you don't want to say anything that comes across as an attack. They'll just dismiss the whole thing as the griping of an upset worker.

Re:Tell infosec.

[Ol Olsoc]

Surely there's a infosec or security group at your company. Let them know. Otherwise, fire a note to your boss and cc'd your second level manager.

Then pack your bags.

Accept it, fight it, or leave.

[smylingsam]

Others have mentioned the need to cover your assets I suggest doing so then consider what useful options you have. Please don't use the below list until your exposure is minimized by documentation and strategic copies showing your knew and reported the problem. Cover your assets !

1) Your skill-set is very valuable, if you don't want or care for a messy fight engage a recruiter and start a job search. Use the exit interview to vent. Feel free to take your favorite coworkers with you -done carefully no one need know you pouched them. IF they like you possess ethics and morals your company may thank you for removing such troublemakers!
2) If you want to make this right, prepare your documentation. Call your internal ethics hotline. Pitch this as serious risk the company faces. Upfront cost vs a very embarrassing civil or criminal investigation. If the ethics line fails you consider locating a Board chairman - someone with enough stock in the game to have the power to protect you, then prepare a overview of your concerns and meet with them. Done with respect and discretion you may not only survive but flourish . But the key is to stay inside the corporate process.
2a) Take a subset of your concerns - the most likely items to be exploited and take those issues , prioritize their cost to implement vs amount of vulnerabilities it will close. The easiest to code that has the highest impact should be number 1, etc.
3) Accept the harsh lesson - security does not matter in most cases. never has, never will. Too much security increases costs, reduces flexibility, makes deadlines slip.

I've ignored nuclear options - ratting your company out never ever ends well. Witnesses, whistle blowers have little protections and the world is awash in talented Senior Architects working at tech support firms for us$30k per year.

Good luck!

use sarbanes oxley, reporting unethical behaviour

[Anonymous Coward]

You can report unethical to the ombudsman designated under the sox act. I once worked at a well known technology company. The company reduced our salary after giving us lay off notice, termination almost a year out. That violated employment standards act in our jurisdiction. As once notice is given they cannot change your pay for the remainder of your employment.. One of my colleagues reported this unethical behaviour to the ombudsman, the net result was that we got back pay, salaries were restored, the responsible HR people and the managers were reprimanded.

Corporate Compliance Hotline

[Anonymous Coward]

If you work for a fortune 500 company will will have a corporate compliance hotline that is completely anonymous. It is likely posted by your HR department. Calling that will protect you and make changes happen without anyone needing to know.

Whistle blower

[Anonymous Coward]

Leak to the media and run to Russia a la Snowden. There's an IT job over there you can get

memo

[Spazmania]

I didn't "lose" the job any more than I "lose" a defective computer when I throw it in the trash. Indeed it would be very hard to consider it a loss when six months later I was earning $10k more per year.

Nor did I put myself in any legal jeopardy. I'll spare you the lengthy analysis.

Best way to handle the problem? Burning bridges rarely is. But sometimes it has a moral righteousness that's hard to defy.

Re:B'OH!

[TapeCutter]

This isn't a Dr. Evil plot, the boss isn't hiding anything from anyone, the boss simply believes other things are more important than a secure web site. "Web sites are cheap but a secure one is expensive" - is probably closer to the level of thought running through the boss' head. Programmers are not automatically "right" every time the say something needs doing. The boss in TFA probably sees the programmer as a loyal employee who's concerned about the quality of his work but is blowing the problem out of proportion.

It's a hard life lesson for geeks to learn that "correct" is not sufficient evidence to convince others to follow your lead in the real world. Of course you should cover your arse, but if that is your only motivation then your no better than the DR. Evil you describe in your post. If you turn the issue into a battle of wills, or a gotcha moment, then you will more than likely lose the argument and it will become more difficult to raise the subject in the future. Nobody benefits from that, least of all the programmer.

OTOH arseholes do exist and if you have one as a boss in a small to medium sized business there is little you can do about it other than to walk out. Don't think of it as quitting, think of it as sacking the boss.

Disclaimer: Developer with 20+yrs experience, computers are easy, people are difficult.

Ideal vs. preponderance, do print with all headers

[raymorris]

Ideally, one would backup the entire mail store, take a hash, document the whole process in detail, and quickly get a read-only copy on CD to a trusted third party such as an attorney.

More likely, it won't be a problem. A civil case is decided by the preponderance of the evidence - which ever appears most likely. If you have a copy and they don't show a copy of a different version, it's most likely your copy is correct. Of course that depends on which side seems more trustworthy - judges and juries, like all people, have a feel for who is lying to them.

The other side can either a) claim you edited the messages, which they know because "here's the original copy" or b) claim the conversation never happened. If they do a), they'd need to falsify evidence themselves. Any party who goes to the extreme of creating false evidence will probably out themselves as full of BS somewhere along the line. They may well say "I didn't read that email", at which point you pull out their reply. Wham, you've just proven they are being untruthful.

Bring boss facts and a tech recommendation, don't

[raymorris]

I would extend that to say don't ever tell the boss what they need to do in a way that implies they don't know how to do their own job. That can be tricky if you are recommending that they reverse their own decision. Don't "act like you're smarter than the boss".

What has worked for me and people working for me is to bring facts along with a "from a programmer's perspective this option looks attractive" recommendation. Change "programmer's perspective" to whatever is appropriate. For many years I did IT security. CxOs would sometimes ask "should we do this" or "what should we do". I try to remember to answer "that's a business decision that's up to you, but FROM A SECURITY PERSPECTIVE ...".

The idea is to recognize and explicitly state that you are looking at it from a specialist's perspective, focusing mostly on one aspect of it. What you don't know, but the boss may know, as if they are planning on scrapping the entire project next month anyway. I can't tell the boss that we should upgrade X, because as far as I know the entire division that uses X may be getting laid off tomorrow. What I can tell the boss that that an upgrade to X would provide benefits Y and Z, at a cost of A.

I am a script kiddie and doodler

[Anonymous Coward]

Any senior engineer can secure an app. Sounds like you just suck...

Security is overrated

[Anonymous Coward]

Your house isn't secure-- anyone can walk by and throw a brick through your window. Why don't they? There are other ways besides an attacker-proof house to discourage the attacker from throwing the brick! :)

If you enjoy your job, stay on. Save a copy of the emails you send documenting the security issues in a non-company controlled space. They might be useful when you part ways with your employer.

Sell that shit

[Ryanrule]

Sell that shit.

Also, FUCKING Name Names.

Compliance Office!

[Anonymous Coward]

Review the Employee Manual. There must be a section on Compliance. Contact the Compliance Office and let them know you are concerned not only about the issues you have raised but that you would also prefer to remain anonymous to the parties responsible for the debacle. Your management has already spoken.

Also, you must, clearly and concisely, enumerate the issues their implications, and proposed resolutions (as much as you know about that). It seems that no site is perfectly secure, so you need evidence that your site is far worse than the norm. Bullet points or a tabular format make it easy and get directly to your point.

You want to be careful not to come off all "ranty". That weakens your message.

Contact Ethics line, Internal audit, or Corp legal

[walmass]

Fortune 500? Publicly traded company?

Then there is an code of ethics violation reporting mechanism. Contact them, contact internal audit, or contact corporate legal.

Reporting to the code of ethics violation provides you the strongest protection, because there is a stated policy that you cannot be retaliated against (still no guarantee that you will not be, just that it will help you in the subsequent multi-million dollar lawsuit you can bring). Make sure you mention the violation of COPPA and ask THEM to contact corp legal.

Also understand that you will not be seen as a hero. You will be branded as a troublemaker, so better be ready to switch jobs.

(Yes, I have been in a very similar position)

PS: I see some advice about documenting your interaction with the manager for the time when the shit hits the fan. Trust me, will not help you a whit if it came to that.

CYA

[Anonymous Coward]

First, contact an attorney that has experience in whistle blowing.
Second, start lining up another job before attempting anything.
Third, try the CEO or President. Remember Sarsbane- Oxley? You'r CEO's ARSE is in the noose if any of this 'could' and 'does' impact the financial statements of the company. Should the information become public and it has a financial impact, you CEO may face jail time if as he has to sign off on financial statements, software exposure, etc. IF he is aware of the problem and does not deal with it, you may be able to visit him at the Federal pen. once a month.

I'm sure that CEOs like it when others remind them that they are only a few key clicks away from prison. So CYA.

Quit

[BringsApples]

I had basically the same situation at my last job. I fought it for years, talk about 'working on your nerves'. Anyway, I finally quit. After that they got some other guy to take my position, and he quit 3 weeks later. They eventually had to restructure the company, but did so in a way to keep the stupidity that caused us to quit. They're a failing company now, and I've moved on. Now I'm self-employed and am able to pay my bills. Aside from being able to sustain my life with money, I'm also able to sustain my sanity, and I'm a lot better to be around now, I hear.

Ask Legal for what compliance means

[Sir_Sri]

Lots of what other people have said is good.

Approach legal and tell them about our many violations of COPPA?

Ask legal what framework you should be working under, and what laws and compliance are going to be required as part of doing your job. You aren't really sure what your personal obligations are in this regard, because you understand that there are regulations but you aren't sure who is responsible for implementing what exactly, and you've gotten conflicting or confused responses from your superiors.

Who is 'itself'

[fisted]

... and why is he annoyed when someone tells someone else about him?

What woudl I do?

[koan]

I would email the bosses involved, advise them of the security issues, turn in my one month notice, go to a hackers forum, give them all the information, wait until the site is hacked (oddly enough just shortly before my one month is up) and when they come crying to me to save them I'll say "I already have another offer since I quit".
Then tell them I'll take double my old salary to be rehired, and tell them how lucky they are to have me.

Yes... I'm joking.

New job

[Anonymous Coward]

You can't care more about security than your boss does. You'll always be frustrated. Time to move on.

The good news is that people are looking for good security engineers and it sounds like you're passionate and knowledgeable. Go out and find a job you love.

I have dealt with this too.

[Anonymous Coward]

I was not even a developer at my old company (whom I shall not name, but I can assure you its products in some form are on almost 100% of windows machines).

I started in tech support with a bunch of pretty brilliant guys and gals who needed a tech job during a recession. Most are developers now, one gal went on to get her PHD, I decided to become a Consultant as I was not as smart as some of them, but had good people skills.

I complained for YEARS (even in Support) about the security of our web application. Not even real complicated stuff like buffer overflows, but just how passwords were stored (vanilla SHA1) and a few other things like blanking passwords from logfiles and such. When I became a consultant, I wrote a whitepaper detailing how one could spend about $10k and build a machine that would crack practically EVERY password in the application's database, and explaining in detail why this was likely to be a bad thing.

To my knowledge, nothing ever came from this. But I will say, I have moved on to a much better paying company since then--one that listens when I talk.

What is the risk level?

[TomGreenhaw]

Is there personal health information (HIPPA/HITECH), or credit card information (PCI) at risk? If so get another job immediately and if personal circumstances permit, give notice immediately. This may be also advisable if you have information about specific minors.

If the above is not the case, the company's reputation is at stake and the millions that would be spent on PR firms to patch a PR mess should be forestalled. Tell the boss that a little CYA may not be a big deal. Take a look at Nessus, Metasploit and WireShark. Use the free trials if you have to. A pro will put in some extra hours to learn these tools. This should readily uncover the egregious risks.

Today anybody who doesn't make reasonable efforts to bake security into their code should be held accountable. Since you've outsourced the work, the vendor should stand behind their work. They are likely obliged to under their master services agreement - but don't wait too long.

Don't you have a Chief Security Officer or an information security policy? Discreetly tell those kind of guys your concerns and I bet you get action, especially if you have some reports from the scanning programs I mentioned.

Possible other way

[Anonymous Coward]

Your boss is a /person/. They may not be prepared to accept 'you're an idiot' in a formal context but /might/ if approached with alcohol+confidential environment. (I say this to alert other geeks to more touchy-feely-social possibilities in their own bear-pits.)

Stop Whining, Slappy

[Anonymous Coward]

Regulation will not be taken seriously unless it has teeth. COPPA violations have netted huge fines - as much as a MILLION DOLLARS!!!!1111!!!! - for people violating it. You claim you work for a Fortune 500 - a million bucks is pocket change, and easily paid. How much do they lose by not releasing the software as quickly? Probably more than a million dollars. Given the choice between "Earning 10 million dollars this month" and "earning 20 million this month, and paying a 1 million dollar fine for rolling out software quick & dirty," most companies will choose the option that puts 19 million dollars in their pocket at the end of the month, instead of 10 million.

You're not going to jail for "COPPA violations." Your company may eat a fine, and if you have the ability to show that you did your due diligence in reporting these possible violations and advocating for them to be addressed, then you're not going to jail, or eating a fine.

Compare with what will happen if you just flat-out refuse to deploy code until the issues are fixed: Great, enjoy looking for a new job. The company will still make 19 million dollars this month.

The problem is, if you want to actually fix the issues, you're whining to the wrong people. Your colleagues and your manager, like you, are powerless in this organization - you've admitted it when you say you're just handed shit by marketing and told to publish it to the web site. So, you can either find an ally in marketing or other upper corporate management functions, or you can whistleblow to an external agency. Those are your options to fix the issue; If you don't care to do that, then nut up, hand in your resignation, and take your skills elsewhere.

Who cares

[Anonymous Coward]

Just get it in writing (email) to CYA and chill. It's their business to run into the ground, not yours. If they want to put themselves at risk, that's their choice. If you don't agree with the poor security decisions, it's a free country (find a new job).

One suggestion

[jonwil]

Assuming the website really violates COPPA, Google "COPPA violations" and grab some links to articles showing where the FTC sued over such violations and got big settlements. Then email those links to the boss (keeping copies of all this as others have suggested) and say something like "these guys got sued by the FTC and had to pay some big $, do you want to see our company get sued?"

If the boss takes an "I dont care" attitude or ignores the emails, go to the legal department or compliance officers with the same thing and say "I pushed this to my superiors and they chose to ignore it, I dont want to see our company held liable by the FTC, what should I do about it?"

If that doesn't work, consider packing up and leaving. Any company where the legal department doesn't care that the company is violating such a law and is one tip-off away from an FTC investigation (which could be a PR nightmare especially for a site that targets kids specifically) isn't a good company to work for.

I'd leave Microsoft

[TheGoodNamesWereGone]

I'd leave Microsoft and get another job

Re:I'd leave Microsoft

[Anonymous Coward]

LOL!

Re:I'd leave Microsoft

[Anonymous Coward]

slow clap

This is a lose-lose situation

[Anonymous Coward]

Quit and go work somewhere people/management aren't such dickheads! This company's systems are going to be pwned PDQ, and you DO NOT want to be there when they are!

Raise bug

[SergeDupuis]

Blow the whistle and move to russia

Document, hire friendly hacker

[manu0601]

Document the vulnerabilities and the impossibility to fix them so that nobody can tell you did not make your job. Then hire a friendly hacker to break the product without doing any harm beyond shame. And never tell anyone you did that!

Bring in the pros

[Anonymous Coward]

There are a number of network security firms out there who's whole reason for being is testing how vulnerable a company is, teaching the IT staff about how to plug their holes, and most importantly, providing the IT department (or often CTOs) with the ammunition required to convince stubborn CEOs that they need to put on the breaks and sink some serious resources into network security. These firms have all the facts and figures to be able to say, "you've got x y and z security holes, it should take this many man hours to fill them and if you don't and a hacker gets through your security, you'll not only need to fill the holes then but you'll also have to do a bunch of audits which are pricey, you'll lose rep, your brand will be damaged, and if they get to personal information of your clients you could be blackmailed for millions."

It's not always easy to convince people to hire a firm to do some security testing but generally its a lot easier than requesting the resources to fix security issues without a third party telling you it needs to be done.

I suppose the other way to fix it is to just publish the name of your company alongside your question... Shouldn't take long for you to get a free audit from some hackers that'll convince your boss...

Grow up

[Anonymous Coward]

I was fortunate to learn the correct attitude to this as a third-grade child.
My brother and I were raised in two different countries, 2000 miles apart.
So when he came to visit, I wanted to show him "my school".
The Principal very patiently explained to me -- taking all the time it took to make sure the lesson was as deeply implanted in my mind -- that "my" in "my school" had different shades of meaning, and in this case it simply meant "the school I went to" but it was really *his* school, and it was not appropriate to bring my brother to see.

Much later in life, I was taught that "my company" was not really "my company".

So yeah -- cover your ass so your boss can't shift blame onto you, and get on with life.

Blow the whistle

[drakesword]

then run to russia

Sell Short. Post on /.

[Anonymous Coward]

Go look at the company's 10-K. Look at the numbers for goodwill and marketing budgets. Most of the powerful people in the company cares about assets and risk.

Depending on what you want your career path to be, choose one of the three following options. A) Do nothing and document the hell out of your escalations and communications so that your hind parts are insulated. B) Find another job. C) Grab this opportunity to demonstrate that you can "contribute to business outcomes by being proactive" and put a proposal that both identifies a problem and a solution with a financial analysis of cost vs. risk.

It's your life.

There's no one over your boss' head

[Gothmolly]

When your boss is the President. We all know what application you're talking about.

Send your bosses Slashdot links

[Anonymous Coward]

... and get them to sign up to Sony and Adobe.

It took me three years of emailing Slashdot links to the Development Manager and Product Manager as each data breach story came out. But they only finally took action when their own personal account (and credit card) details got compromised in the Adobe breach. Now we have salted and hashed user passwords plus a full-time person working on checking and fixing security issues.

Re:Bring boss facts and a tech recommendation, don

[mysidia]

CxOs would sometimes ask "should we do this" or "what should we do". I try to remember to answer "that's a business decision that's up to you, but FROM A SECURITY PERSPECTIVE ...".

Too wordy.... "We would recommend X, because Y and Z."

A true security professional is not going to look on everything, purely from a perspective of maximizing technical security -- they will be concerned about the whole Risk management / Usability tradeoff thing.

....as I know the entire division that uses X may be getting laid off tomorrow.

That's what is called pertinent critical information; that you had to know to make a reasonable recommendation in the first place.

Obviously, you have to be informed about such known/planned things to make reasonable recommendations about anything they may affect.

you cant make people do the right thing

[Anonymous Coward]

do the CYA....document the recommendations and the responses....
happily take the company's money until they fail from their own stupidity or you find another job....

Horrible truth

[EmperorOfCanada]

I have seen leaked code from many very successful products. Typically it is shoddy and full of security holes (hence why it was public) yet the companies behind it were and generally are doing quite well. Personally I am a fussy about making my products solid and secure; but I hate to say it but quick and dirty makes for a better business model.

So as many people have advised, document your worries, but even better find the various security problems and come up with a solid recovery plan. Then when the day comes and things go to hell you will be able to save the day. The only thing to do with your documents is not to play the blame game ( you will lose to some MBA asshole who will take you out before you can do any damage to his career) but to be able to show the MBA looking for a scapegoat that you aren't going to be easy prey and for them to find some other person to blame.

So in the end you will be a hero, not a scapegoat, and will have all the resources to fix everything for a while at least. What you will never be is vindicated.

Re:Horrible truth

[Pherdnut]

It's never quicker. It's just stupider. Success at buying congressmen to steamroll all opposition and obstacles for you doesn't equate to a smart product.

Re:Horrible truth

[EmperorOfCanada]

By better I meant more money. Many of the top websites out there have done emergency rewrites a their weak code failed under load. But I suspect that if they had carefully crafted their code "properly" from the start they would have been late to market, run out of money, or culled critical(to their success) features to meet various deadlines. The damn the torpedoes approach might not appeal to the craftsmen in many of us but if you simply use the score of how many dollars it generates then poor code has a horrible habit of scoring quite well.

Re:Horrible truth

[Pherdnut]

Maybe I've just never been on anything huge enough but I just don't see how cutting corners on security saves you a lot of time for the actual code-writing part of it. It might save you time on talent acquisition or vetting third party stuff, I suppose.

Re:Horrible truth

[EmperorOfCanada]

I think the physical world version is when developers build crap houses during a housing boom. Leaky roofs, crap foundations, cheap hardware, shoddy workmanship, often even crossing the line into bribing building inspectors to allow even legal corners to be cut. But in the hysteria of the boom the shoddy developer will make far far far more money than the craftsmen. The price for this crap workmanship is often only paid during the downturn when the people who bought the crap houses have a very hard time maintaining them and selling them.

So it all depends on the timing and this is where fast and shoddy is potentially an asset. If you realize what the market needs right this second and produce it right this second then you will start to scoop customers by the boatload. Then (unlike houses) you can go back and rebuild properly. I have heard that the programmers at Google complain about the crap original code that the founders did. The Twitter code was crappy ruby and then replaced. I suspect that even things like Youtube was crap but then replaced. Reddit was done in lisp and then replaced in something like 24 hours in python.

But if your product is not all about timing, say building an upgraded POS(point of sale, not piece of sh..) system for a store then craftsmanship should probably be rule one.

Re:Quit

[Anonymous Coward]

You can also now smoke all the weed you want.....maaaaaaan....

You're screwed

[shentino]

If you give notice and leave you'll get branded a quitter. If you speak up to anyone you'll get branded a troublemaker.

Can you personally be held liable for anything? If so, then jump ship before it sinks with you on it.

Chances are you're already screwed no matter what.

The right way

[Confused]

Work the system and treat the boss just like you would handle a system bug or limitation.

Step 1: Get it into your official procedure, to do some kind of acceptance test or quality checks for software delivered by 3rd parties. This can often be done innocently and disguised as a formality.

Step 2: Improve the acceptance test procedure so that the pieces of garbage with security holes will fail Here, make sure the improved tests become official and rubber stamped.

Step 3: When at delivery the tests fail, raise a critical ticket with the delivering company. This works best if you managed in step 2 to make the test part of the acceptance. Now people will start to feel the pain, because a failed acceptance and a piece of software marked as "Not Ready for Deployment" will have commercial impacts. People will curse and try to force it through.

Step 4: While the shit is flying your way, make sure you stay reasonable, helpful and stick very closely to the official company procedures. Get acquainted with the QC department and ISO-whatever proceedings. Don't be controversial, never bad-mouth anyone. At the same time, document your cases, print out the mails where people attach your message to their replies.

Step 5: The software will be rolled out no matter what you said, but now you have a proper documentation of how your boss and the marketing department bend and break the holy official rules nobody want to keep.

Step 6: Various outcomes
a: People in marketing hate your guts now and avoid you as much as they can because you're branded as difficult. Problem solved for you.
b: They want you to do it again next month. Some chances are that the delivering organisation learned that releases are smoother if the software doesn't fail the test devised by that crazy lunatic in software engineering (this means you). A slow increase of security will ensure.

Step 7: Somewhere down the road there's a big chance the company will get into troubles because of their faulty software. Make sure, the people investigating that get access to your documentation.

Easy

[Anonymous Coward]

Plant kiddie porn on your boss's computer and get him fired.

Do you care about yourself or the company?

[Anonymous Coward]

If the security nightmare is going to cause problems for the company and you care about the risks to the company, then wistleblowing is a good option. But if you don't care about the company but would like to protect your backside, then you need to ensure that you professionally raise the issue with the boss once or maybe twice and CYA. Of course, it can still come back to bite you, so as insurance you might want to start looking for another job - which does not necessarily mean your next boss will be any better.

Re:Bring boss facts and a tech recommendation, don

[BACbKA]

answer "that's a business decision that's up to you, but FROM A SECURITY PERSPECTIVE ..."

I don't know what the OP's particular situation is wrt business perspective --- could it be that the bosses actually are looking at a tradeoff "ship now with internally known security problems, or try to fix them and not ship at all, and fail as a business"? If this is the case, one should probably think how to gradually integrate better security in long-term. Certainly, if there is a criminal negligence going on, then the "ship with known problems" is not an option! It is very easy to over-hype security, but remember that, in the end, it's all down to business bottom line. If you have a supermarket chain with some casual shoplifting happening, sometimes you want to invest $$$ not into more security guards and anti-theft tech that frustrates the customers, but into everything else --- maybe opening a couple of more locations --- and in the end turning more profit from the same investment.

Techleaks

[Z00L00K]

Here in Sweden we have a service called "Techleaks" (https://www.techleaks.se/sa-kontaktar-du-oss-via-techleaks.html), use Google Translate to get another language if needed.

This seems to be a way if nobody in top management listens.

Complaints Department

[nine-times]

I don't know what the structure of your company is, but many of the larger companies i've worked for has had some kind of 'complaints department', although that was never what it was called. In one company, if you saw something bad happened, you went to the CEO's assistant. In another company, it was the head of HR. I don't think any of this was officially stated, but people generally knew, if you're having a serious problem, this is person is the release valve. It's the person who you go to and say, "I don't want to go over my boss's head, but...," or "I don't know who to talk to about this, but..."

In a big bureaucratic company, they should have some person, or some kind of mechanism, for complaints about your own boss that isn't breaking the chain of command. They might not be able to fix the problem, but they might be able to give you advice on what to do, from the perspective of someone who knows your company.

Re:WWMCD?

[Anonymous Coward]

Ask Betty?

check the company security practice

[Anonymous Coward]

I developed security controls for one particular technology in a Fortune 50 company and ran into this situation many times. Your path forward is to check the employee code-of-conduct documentation. In my company, it said that security vulnerabilities could be reported either to the security department or to management. I made sure management received reports about the vulnerabilities and I made sure that they knew I did not have the authority/resources to close those vulnerabilites. (All of this via a documented trail as well as during meetings in which multiple employees participated . . . I had my butt covered, legally.)

Ultimately security comes down to this phrase: everybody is responsible for their own sandbox. Security issues that can be solved only by management action must be solved by managers. If a manager chooses not correct issues, that's his responsibility. In one case, I advised my division manager that according to company security practices he did not have the authority to make a particular security decision, and if he wanted to protect himself, he should get permission in writing from his own manager. Which he did.

Would Marketing like a front page breach story?

[essbase_nerd]

Show marketing a few high profile breach stories, tell them that you won't be surprised if you're next. They probably aren't aware of the risk, and will re-prioritize initiatives if you educate them.

Whistleblow

[Anonymous Coward]

Disneyguideline.com

It's not just CYA...

[hey!]

it's a question of professional ethics.

That's what makes this tricky. From the point of view of professional ethics, avoiding harm to the users is paramount. But some of the things that are justified by professional ethics can be bad for your career, like going around your boss's back to your boss's boss. Depending on the corporate culture and how old you are, it could be a career ending move. If you're under 30 and obviously have marketable skills, go for it. If you're over 40 and have a family to support, you want to bring your spouse in on the decision. In fact you probably want a lawyer too.

From a pure CYA standpoint, documenting everything but not rocking the boat might well be the safest position to take *for you personally*. It may be very bad for your company and your product's users.

Re:It's not just CYA...

[Cederic]

I could draw in my professional body too.

Hell, I've committed to maintaining professional ethics as part of my professional accreditation. I had no hesitation, it needed no change in attitude from me.

I'm just better at the diplomacy on these issues than I used to be :)

Base a common language

[Anonymous Coward]

Mangment usualy dont care much for detail. IT Security risks sound to them as one gory blah blah blah.
So right after covering your ass. Invite a Proffesional IT security risk Assesment, ask them to tag a price to each potential risk and potential safeguard.
Then arrange a mangment meeting and let the outside experts to present it, you will do the sum up.
It is very important that you stay positive, start with the good things, and present a proposed plan (with budget and priorities) to close the gaps.
Good luck.

Read receipts?

[antdude]

Read receipts? Most e-mail (service/host)s and users disable this feature due to prviacy reasons.

Find the security group

[Anonymous Coward]

Find the IT security group and tell them. They'll be very interested in what you have to say, and since they're outside your direct chain of command you're not going over your boss's head, but you're also not going outside the organization. Also the security group should be able to help articulate the issues to management, and can help marketing (or whoever is writing the code) fix the issues or mitigate the vulnerabilities with other controls. Depending on how your organization is structured, they may be under the IT group, or they could report separately, perhaps through a name like "compliance". If you can't find something analogous, at least try finding someone in internal audit who does IT audit - every internal audit group I've ever met does some IT audit.

Document... and store offsite

[whitroth]

As others have said, save all copies of email between you and your boss informing them of the flaws. Make sure all future emails are return receipt requested. Print them out. Take copies home... and then buy a safety vault in a bank, nothing less, and store them there. That way, they can't be made to disappear so easily.

Yes, I knew someone who lost their federal job, and the documentation at home disappeared.

                mark

Create a fake social media account

[Marxist Hacker 42]

And then from a Starbucks, using their wifi, post a meme picture saying that "X website has no security- don't use a critical password or personally identifying information for your kids unless you want them kidnapped by a sex abuser" on the App's facebook page.

Never own up to starting the meme, but watch things change VERY quickly.

Re:Ideal vs. preponderance, do print with all head

[Anonymous Coward]

What is all this about backing up to physical media? Back it up in your personal email. Back it up in a cloud storage solution. Just because your company controls the digital resources on their LANs doesn't mean they do so on the entire internet. Burning cds, sealing them in envelopes and clutching them as you're per walked out is a lot more conspicuous than sending yourself an email, strolling out with empty hands and not a care to give, and downloading it at home.

Re:B'OH!

[Tablizer]

computers are easy, people are difficult.

I would instead say that computers are predictable, people are not.

Making a web front-end work like a desktop GUI *is* difficult if we target many browser versions. However, we have a general idea of how long doing such well would take. A "difficult" person on the other hand can be very difficult to predict and communicate with, making life too unpredictable.

True, a desktop metaphor may not be appropriate or economical for a given organization, and convincing the boss or customer of that may require some solid people skills. It's two factors intertwining: technical issues (UI) and people issues (expectations of UI). They both can be difficult, but the second is less predictable.

Get. Out.

[Anonymous Coward]

Get a new offer, then leave. I have done consulting gigs and full-time work with some of the more-visited sites on the Net, and many of them showed blatant disregard for their customers' security. I actually had a CTO of a major net company tell me "there is no such thing as Android malware, you are making it up" and "my engineers write secure code" without any code reviews or even basic security awareness training. This year. Some refused to admit they could have security problems even after I demonstrated them. Just go. You cannot win.

Oh, and HR/Legal WILL hose you without a doubt. I recall talking to an HR person at a company I was with about what she would do if someone came to her for substance abuse problem counseling. She, without batting an eye, said she would do everything she could to fire the employee as they are nothing but a liability. Most view their job as protecting the company vs. advocating for employees.

Life sucks, move on. Laugh when they get owned.