Timeline for Raised concerns about a security vulnerability to various managers, for more than a year, with no results. Should I mention it to external auditors?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 18, 2019 at 11:49 | comment | added | O. Jones | @DavidRicherby Of course auditors aren't the enemy. Cybercreeps are enemies, and formidable ones. My critique of audits is this: they tempt us to think we're safe if we just follow all the security rules and construct our Maginot Lines according to best practices. | |
| Nov 16, 2019 at 15:41 | comment | added | Daisuke Aramaki | Another consideration is that you do not have full knowledge of the situation. And it could be that you have no "need to know" anything further. Stay away from the auditors. You have done your job. | |
| Nov 16, 2019 at 9:53 | comment | added | David Richerby | " Generals are fond of saying 'battle plans never survive first contact with the enemy.' " Great, but auditors aren't "the enemy." | |
| Nov 15, 2019 at 18:36 | comment | added | crenshaw-dev |
Auditors can't fix problems. They can only give the company a hard time. If non-compliance is a problem, then giving the company a hard time is the way to get it fixed. As a consumer whose personal data is floating all around the internet, I'd be livid to know that the convenience of sloppy security practices were justified by the desire to avoid "a hard time."
|
|
| Nov 15, 2019 at 15:11 | comment | added | ebwb | It doesn't sound like the case here, but I think this answer could also note that it's possible that this vulnerability (or some other general one) might already be mitigated by some other process or team that OP doesn't know about. John from the book, The Phoenix Project, comes to mind (though OP sure doesn't sound like John :) ) | |
| Nov 15, 2019 at 14:30 | comment | added | bain | Linking concerns to the audit as @delinear suggests is probably a good idea: "I'm concerned that the auditors may ask questions about <gaping security hole>. How should I respond if they do?" Would be an innocent way to broach the subject. The written reply will inevitably be "you must tell the truth", which effectively clears mentioning it, if you are so inclined. Merely raising the question may be enough to get the issue fixed though. | |
| Nov 14, 2019 at 18:33 | comment | added | Kevin | "battle plans never survive first contact with the enemy" I prefer the way Mike Tyson said it "Everybody has a plan until they get punched in the mouth" | |
| Nov 14, 2019 at 17:05 | comment | added | Mindwin Remember Monica |
Auditors can't fix problems. They can only give the company a hard time. I have mixed feelings regarding this line. If by giving a hard time you mean detecting problems, then yes. But compliance is required for some sectors. Crappy auditors will make up molehills out of orbital electron excitement, so yes. Those give the company a hard time with no benefit. Disclosure: I'm not an auditor
|
|
| Nov 14, 2019 at 14:42 | comment | added | delinear | And if they don't have it in writing already (maybe it was a verbal discussion with previous managers), now is a good excuse to formalise it in writing - using the audit as the reason for flagging it again. | |
| Nov 14, 2019 at 13:34 | comment | added | O. Jones | @PeterMortensen I did suggest putting the vulnerability in some kind of writing. If this is an org with a ticket scheme (Jira or similar) that's the place to put it. | |
| Nov 14, 2019 at 12:53 | comment | added | Peter Mortensen | But a CYA letter wouldn't hurt? | |
| Nov 13, 2019 at 22:48 | history | answered | O. Jones | CC BY-SA 4.0 |