Take the 2-minute tour ×
The Workplace Stack Exchange is a question and answer site for members of the workforce navigating the professional setting. It's 100% free, no registration required.

I work for a small company with a couple of directors and several staff who all report directly to them. I'm the senior PHP developer here and over the last few years have built a content management system and I have just finished developing an e-commerce platform that we now sell.

Throughout my time here I've always had to fight for security to be given its due concern. For example, we have a test VPS server that was running MySQL v5.1, no longer supported and when cPanel stopped patching the server due to the MySQL version being out of date my bosses seemed completely unconcerned and were more concerned with the down time to update the server where people wouldn't be able to work. In the end I had to upgrade the server in my own time to make sure it got done.

There have been regular things like this where things that are important in my eyes just get glossed over by my bosses. It seems like the only thing that will make them sit up and take security seriously is a breach that affects our clients, and I'm just waiting for that day to happen when I'm going to have to clean up the mess.

How can I impress upon my bosses the importance of security? Or am I just being paranoid here?


I don't think this is a duplicate of Convince the Company I Work for to Implement Version Control? because the answers to that questions are about understanding why a process is there in the first place, and then figuring out how to change them. With my question there is no process there in the first place, and it's more about changing attitudes than processes. It's similar and there will probably be some crossover in answers, but I don't think it's the same.

share|improve this question
1  
39  
One thing definitely not to do is fixing these issues in your own time. That reinforces the management opinion that it is not important. –  Jan Doggen Aug 8 at 8:46
6  
@StephanKolassa I don't think this is a duplicate, I've updated my question with reasons why. –  Styphon Aug 8 at 8:59
5  
There is/are similar question(s) on security.stackexchange. –  StupidOne Aug 8 at 13:31
3  
This question appears to be off-topic because we've decided that these kinds of questions aren't a good fit for this sure: meta.workplace.stackexchange.com/questions/2132/… –  Jim G. Aug 8 at 23:08

5 Answers 5

up vote 58 down vote accepted

In the end I had to upgrade the server in my own time to make sure it got done.

You made sure something that was an issue, became a non-issue as far as your managers were concerned. Next time it will be more difficult to convince them it is an issue (because "it wasn't in the past").

How can I impress the importance of security to my bosses?

You can't. What you can (and definitely shoud do) is make a written risk assessment and make sure your bosses read it. In it, describe the security risks, what (reasonable/affordable) actions can be taken to mitigate each risk, and what is the cost of not taking said action.

Example:

risk: server broken into, from the outside
probability: high (see statistics of compromized
    non-patched servers, at http://example.com)
cost: client financial records compromised (along
    with company credibility and public image),
    **loss of sales**
recommended action: keep servers up to date
   (requires 1 man-hour every two days)

risk: fire into the server room
probability: low
cost: loss of business and all backups
recommended action: update backup policy (requires 4 man-hours and the server offline)

risk: compromized company records
probability: ???
cost: compromized employees financial records
recommended action: restrict database access to X, Y and system administrators
    (requires 1.5 hours, best done after work-hours)

This way, you have brought the issues to your manager's attention, and it is up to them to take a decision (or not).

If you provide a written assessment, it is more difficult to ignore, and in case something happens, you are legally covered (your manager cannot say afterwards "but you're the security expert - it was your job to make sure this didn't happen).

share|improve this answer
12  
Paying for security is like buying fire insurance. It feels like wasted money until the unthinkable happens. –  Dan Pichelman Aug 8 at 14:50
3  
This is a smart answer, putting the risks in writing and sending them via company email to your boss takes the responsibility for any future breach out of your hands –  itcouldevenbeaboat Aug 8 at 16:30
3  
Along with what is already there, I would actually add a monetary value in the cost section. Talk to accounting and get their estimates on exactly how much is at stake. Money talks. –  fredsbend Aug 8 at 22:51
1  
If the boss decides after reading this that none of this is worth the time - it probably isn't. This is now a business decision. –  usr Aug 9 at 13:32
2  
@Dan Pichelman, if you pay for good security you should have nothing to show for it. When you use fire insurance, you have ashes. Its a tough sell for this reason, when its done right there are no tangibles because the unthinkable has been averted. Perhaps you can show your bosses some of the firewall logs of people turning the knob to see if its locked and tell them its just a matter of time until someone tries hard enough and the lock breaks. Maybe then the bosses can see you need better locks. –  MaxChris Aug 13 at 15:50

As Jan Doggen has said in the comments, fixing these issues in your own time is not a good approach. You need to explain to your bosses what is at stake if security issues are not resolved.

Firstly you have to impress on them just how many people out there are dedicating their time to breaching security for profit. Often people ignore security issues because they think that it is unlikely that this will ever affect them.

Secondly you have to provide scenarios for each case for what could happen if you don't fix it and someone does get in. Consider the affect on the customers, the time it will take to remove any problems and as a result of these combined the potential losses to the company. People tend to sit up and take notice more when you bring monetary values into the discussion.

If after this you can still not make them really care about the issue then you can either give up or find people who do. Many voices are heard more than just one.

Or am I just being paranoid here?

It depends partly on the vulnerabilities you are trying to address. In the case of SQL if there's any risk of confidential data being accessed or databases being dropped it's obviously a fairly major concern. You also have to assess if your job is at risk if something does go wrong - how protected are you if you prove that the managers prevented you from fixing the offending security problem?

share|improve this answer
4  
Quote from a former boss of mine: "If you think you're paranoid, you're not paranoid enough". –  gnasher729 Aug 8 at 13:32

Sorry, not enough rep to add comments to the already excellent answers.

Here's a few things that might help:

  1. Demonstrate how easy it is to break.
    • Especially if you've got a version of something with a known vulnerability.
    • Obviously, do this in a canned environment ;)
  2. Point out that the world is changing.
    • remember the Target and TK Maxx hacks over the past couple of years? Both of these companies got sued by world+dog (mainly the banks/credit-card companies) because they were shown to be negligent.
    • Yes, failing to update your software which has known issues is considered negligence.
  3. When they say "yeah, but it won't happen to us", say:
    • If the lock on the office door was faulty, would you leave the office unlocked over the weekend?
    • Security holes in software is like having a broken lock, except that instead of having to come into the building to steal our stuff, it can be stolen from anywhere in the world.
  4. When they say "well, we'll just fix problems as they arise", counter with:
    • Okay, but that's the expensive way of doing it.
    • By being reactive, we'll be subjecting the business to unpredictable costs and disruption - it means that you're pulling people off their normal work to fix stuff as-and-when, which is going to threaten project schedules, or you may be forced to do a major upgrade or hire-in an expensive consultant to backport a patch for unsupported software.
    • If we are proactive, we can make updating a day-to-day activity that minimises disruption, because it's all part of the plan, yes, we'd need to invest a little to change the way we work, but that can be planned into our work schedules in a predictable way.
    • Reactive == costly + disruptive (i.e. doubly expensive)
    • Proactive == costly

Security is expected by customers and your suppliers, but more importantly, by the courts.

share|improve this answer
3  
Unfortunately, #1 has an even chance of getting you fired by bosses that would prefer to keep their head in the sand than do something about it. #2 is pretty good though. –  Chris Lively Aug 9 at 2:16

Mitigation instead of prevention

If security is explicitly and intentionally given a low resource priority (as evidenced by the response to your efforts), then you should target the level of risk reduction that you can achieve without spending much time or resources.

The practical level of risk is not so much related to the technical security of the systems. The core concept is [sum over various risks](chance of bad stuff * damage caused by bad stuff). With limited resources you won't be able to reduce all of the risks, or even to investigate and acknowledge them; however, you can take steps to mitigate and limit the damage if/when a security breach occurs.

Simple good practices will take you most of the way there. Ensure that you have multiple current backups (including offsite and offline) and a practical, periodically tested ability to quickly/cheaply restore data and systems. Ensure that your e-commerce system doesn't store any sensitive data that's not absolutely necessary - no credit card data (outsource it and the PCI DSS compliance to someone who can do it well), no unhashed passwords, no personally identifiable data on test systems, etc.

If that's properly handled, then your example with test VPS server becomes trivial - will extra 2 hours of maintenance downtime save us 2+ hours of hacked-server downtime over the next year? You should have an estimate of downtime-per-incident from your backup procedures and an estimate of hacked-servers-per-year from history, assuming your security practices are mostly the same level. And yes, it does imply that if that particular system is semi-disposable (can be recovered by spending half a workday or less and no other damage) and your systems haven't been hacked in the last two years, then many time-consuming security activities would actually be overkill for that system.

share|improve this answer

There may be two separate problems happening here:

  1. Convincing your boss that security is important

  2. Convincing your boss that putting time into some task addresses a security risk.

Most of the time bosses will agree with #1 in principle, but don't understand #2. If your boss does not agree with #1 even in principle, I would honestly be really concerned that you will not be able to convince him, but I would try to appeal to the fact that emergency fixes for security breeches will cost the company more money than just doing preventative work.

Make sure you don't get too technical. For instance, one approach to #2 for your particular problem, point out to your boss how Windows tells you constantly that you need to update all the time, or else you'll have a security risk, and that servers are no different.

share|improve this answer
4  
Until you can put a dollar sign and a probability in front of them as far as they can tell you're selling them protection from the boogie man... It's when you pull out that chart the says 100,000 systems compromised in 2013, average damages 230,000$, cost to prevent 30 minutes. (The manager's brain does some calculations and thinks This is a pretty uncommon mainframe, 100K is probably like 1 - 2% which each lost a quarter million roughly... CALCULATING... that means based on the risk probability formula it would land roughly 2500 - 5000$ cost to prevent... less than 100$...) Do it Jim! –  RualStorge Aug 8 at 18:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.