Company doesn't follow security policies advertised to clients

Question

I work for a small consulting company with no formal IT personnel. One other employee and I are the only ones who actually care about information security and network management. We both get a ton of resistance when we try to spend time on improving security because it is not directly billable.

I just discovered that the security policies that the directors advertise to clients and use to acquire all of our business don't even come close to reflecting how we actually operate. Is there anything I can do other than jump ship?

I am rather inexperienced in this side of things as I am primarily a developer still trying to make my break into the security industry. Being one of two primarily 'responsible' for the network now, am I at any personal risk?

Answer 1

If there is a widespread fraud (which is exactly what is happening here from how you describe it) then eventually one of your clients will figure it out, and the will subpoena anyone that works on these projects. I would personally seek legal counsel at this point. You sound like you're in a bit of a legal situation that needs the guidance of a professional that you can talk freely to and that can help guide you through this.

Answer 2

Is there anything I can do other than jump ship?

Nope

You need to jump ship ASAP as it appears your company is engaging in fraud and will at some point be found out. And as an added bonus they may be able to leverage the blame your way. You pointing it out won't do any good as you have already discovered.

As far as hiring an attorney, I really don't see what that will get you other than a big bill. You could look into some free anonymous whistle blowing techniques, but again be very careful that you are not discovered,

Short answer: Time to get the resume up to date and move on.

Answer 3

I am an IT auditor who has experience assessing security controls at service organizations, like your company seems to be.

Being one of two primarily 'responsible' for the network now, am I at any personal risk?

In all the attestations I have done (SOC 1 2, 3 AUPs), the client and service organization / vendor had a contract that is usually signed by senior management of the client and service organization. Establishing internal controls at a company is ultimately the duty of management and unless you are a member of senior management, you are unlikely to be held responsible by the client if the controls are fraudulently misrepresented.

Is there anything I can do other than jump ship?

For what you personally can do, there is nothing much like other answers have said. Therefore I agree that the best decision for you is to leave ASAP. There may be a possibility in the long term for positive change, but given what you stated about management, I doubt thee will be serious improvement in the IT Security stance of your company because Management simply don't care about internal control.

I would not be surprised if improvement, assuming it takes place, will be customer driven in the form of vendor due diligence reviews or SOC audits demanded by new clients before they will consider doing business with your company.

As of right now, if a customer were to require a SOC 1 / 2 (depending on whether service affects customers financial reporting), your company would most likely receive an adverse opinion. In other words, the auditor would conclude based on the lack of reputable evidence that the controls as specified by your company management, as being in place, are not designed or operating effectively. For example, based on what you wrote, there is no way that SOC 2 control objectives regarding Communications are being fulfilled.

As an aside to your question, below are just some additional suggestions for you.

Forget about adopting meaningful information security controls until those those security policies are unlocked and made available to all employees

For information security program at a company to work, all employees must actively participate. They can't do so if they don't know what is expected of them. For example:

1. What should an employee do if they suspect a security incident?
2. How should they report stolen assets such as laptops?
3. If there is no requirement on periodic security training, are employees knowledgeable about attacks that target human weaknesses such as social engineering?

Answer 4

What follows is dark stuff, and I am neither a lawyer nor involved with any business handling it that way.

Be aware that sometimes the difference in theory and practice regarding security policies is informally mutually understood - there are cases where it is the client wanting such policies on paper, probably because THEIR clients want it to look that way on paper, while being very much aware that they cannot get it in practice at a given price point. That game is sometimes played up a food chain of client's clients.

Be aware that costs spent on security are often seen as uneconomical if they are not below ((expected cost when something goes wrong)/(perceived likelihood it goes wrong and you can't make someone else pick up the tab)).

The risk in such practices is that a client might be calculating on being able to outsource the blame to your company if something happens.

The important question for you is: Can you, as the person responsible (to the company) also be held accountable (to outsiders)? This is rather dependent on local law. I am no lawyer and cannot comment on that.

Also it could be important to make sure that your employers management is aware that you, responsible or not, are a) not implementing the formal policy in practice and b) are not told by the accountable person to implement it. If you can gather any proof (eg emails) that would make that clear, do so. If you need to ask explicitly to get it in writing, do so in a non confrontational way that doesn't imply you have a reason (eg knowledge of what the customer was told) to consider current practices insufficient - rather ask whether management wants you to change anything regarding security practices.

Answer 5

Might be a long shot given your description of the company... but you could whistleblow, either internally (to HR) or externally (a lawyer).

There's some useful advice on https://www.gov.uk/whistleblowing to report wrongdoing:

You can tell your employer - they may have a whistleblowing policy that tells you what to expect if you report your concern to them. You can still report your concern to them if they don’t have a policy.

There are other options if you don’t want to report your concern to your employer, eg you can get legal advice from a lawyer, or tell a prescribed person or body.

Edit: If you do go down this route, then there's a good chance the company could be shut down. So, whatever you decide to do, it's time to jump ship.

Answer 6

just discovered that the security policies that the directors advertise

Ask your directors about this.

You make it sound so black and white. And, maybe it is. However, I know a lot of younger workers may be quick to jump to a conclusion like this, without it being right.

Perhaps the directors are implementing certain security practices that you're fully unaware of. For instance, maybe you don't see certain security implemented on a workstation. However, maybe this is being implemented in a firewall. Or maybe network traffic is being scanned by a third party company, using a "cloud" service, before the traffic even reaches your site's outermost firewall. Or maybe the service is being implemented, but only on one computer (a main "server", e.g. in Active Directory this could be a Domain Controller) and is not being implemented in other computers. In all of these possible scenarios, the directors may be innocent.

Or maybe this is an oversight from something that was implemented, but then the implementation was discontinued but the advertising was never updated. (Or maybe the advertising was updated by some marketing/advertising person who made fresh advertising based off of a feature list, and it is just the feature list that didn't get updated.) In this case, something maybe wrong, but if you come out with swinging fists then you could easily make enemies, whereas asking how something is implemented could result in the directors seeing a problems and deciding to ally with you in efforts to do something that was previously seen as being unnecessarily expensive. The same situation could result in an enemy or an ally, based on how you handle it.

So, to Summarize:
If the company is, in fact, being unscrupulous as your question suggested, then there are plenty of other answers providing solid (challenging, unpleasant, but right) advice. However, before starting any fights or taking extreme actions like jumping ship, make absolutely certain just how bad the situation is. Then, talk to them and ask them about existing plans to make situations right, or if we can start making such plans immediately. If they cooperate, you're ending atrocities and making the world a better place. If they don't, at least then you can have confidence that you did what you could to try to correct situations before leaving a toxic situation.

Answer 7

You could be in a sticky situation. You need to differentiate between your and your company's deceptive practices. If you jump ship, the company could blame you for not doing stuff and then leaving. I recommend you talk to your manager about this. Are they complicit in this lie, as well? If possible take written notes after the meeting.

Put forth your concerns, and lay them all out. What is managements reaction? If they do not wish to take your advice on action to take, politely resign, as this is not the sort of company that will help further your career.