3 ms·

I have seen similar situations many times. In my experience managements are ignorant of the risks and are often are the worst offenders as far as lax (if any)

I have seen similar situations many times. In my experience managements are ignorant of the risks and are often are the worst offenders as far as lax (if any) security practices on their own PCs, etc. There is very little you can do. Since you are not qualified to address security features, do NOT attempt to do so. That is not in your job description. Best to document your concerns in writing (as in a hard-copy letter). Give two copies to your manager. Ask him to pass a copy up the chain of command. Keep another copy in some safe place at home. If asked to "fix" security, point out that you are unqualified and that you are willing to do so under the direction of a suitably qualified consultant. The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client information and you don't want to become a casualty in the fallout that may come about.

posixplz 8y ago
> The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client information and you don't want to become a casualty in the fallout that may come about. In the US, at least, proper disclosure of risk to senior leadership is sufficient to protect one's self from personal liability. Make sure you are not committing illegal acts, especially as an officer of the company. If you are not an officer, and you disclaim risk to senior leadership, you should be ok. But, that's not always the case. If you are sufficiently worried, call a lawyer. I have been in a very similar position. Respectable lawyers have no problem spending an hour consulting with potential clients (for free) and will often times give valuable advice, even if they're yet-unretained. I nearly sued a previous employer for firing me (arguably for whistleblowing) after I refused to be silent about illegal skirting of, and leadership's brazen refusal to implement, federally required safeguards for HIPAA, GLBA, SOX, FFEC, etc. In the nine months I spent trying to right their ship, I spent all my social capital accrued at the company - and it started it impact my reputation as a security professional. I wish I had given up (and quit) a lot earlier. Sometimes, the fight is just not worth it. Especially when non-expert execs are micromanaging know-it-alls who can't bear to be corrected by domain experts they've hired.

posixplz 8y ago

> The reason you need to be careful is that under many jurisdictions, your company is liable for considerable penalties for failing to adequately protect client information and you don't want to become a casualty in the fallout that may come about. In the US, at least, proper disclosure of risk to senior leadership is sufficient to protect one's self from personal liability. Make sure you are not committing illegal acts, especially as an officer of the company. If you are not an officer, and you disclaim risk to senior leadership, you should be ok. But, that's not always the case. If you are sufficiently worried, call a lawyer. I have been in a very similar position. Respectable lawyers have no problem spending an hour consulting with potential clients (for free) and will often times give valuable advice, even if they're yet-unretained. I nearly sued a previous employer for firing me (arguably for whistleblowing) after I refused to be silent about illegal skirting of, and leadership's brazen refusal to implement, federally required safeguards for HIPAA, GLBA, SOX, FFEC, etc. In the nine months I spent trying to right their ship, I spent all my social capital accrued at the company - and it started it impact my reputation as a security professional. I wish I had given up (and quit) a lot earlier. Sometimes, the fight is just not worth it. Especially when non-expert execs are micromanaging know-it-alls who can't bear to be corrected by domain experts they've hired.