How can I impress upon my bosses the importance of security?

Question

I work for a small company with a couple of directors and several staff who all report directly to them. I'm the senior PHP developer here and over the last few years have built a content management system and I have just finished developing an e-commerce platform that we now sell.

Throughout my time here I've always had to fight for security to be given its due concern. For example, we have a test VPS server that was running MySQL v5.1, no longer supported and when cPanel stopped patching the server due to the MySQL version being out of date my bosses seemed completely unconcerned and were more concerned with the down time to update the server where people wouldn't be able to work. In the end I had to upgrade the server in my own time to make sure it got done.

There have been regular things like this where things that are important in my eyes just get glossed over by my bosses. It seems like the only thing that will make them sit up and take security seriously is a breach that affects our clients, and I'm just waiting for that day to happen when I'm going to have to clean up the mess.

How can I impress upon my bosses the importance of security? Or am I just being paranoid here?

---

I don't think this is a duplicate of Convince the Company I Work for to Implement Version Control? because the answers to that questions are about understanding why a process is there in the first place, and then figuring out how to change them. With my question there is no process there in the first place, and it's more about changing attitudes than processes. It's similar and there will probably be some crossover in answers, but I don't think it's the same.

Answer 1

In the end I had to upgrade the server in my own time to make sure it got done.

You made sure something that was an issue, became a non-issue as far as your managers were concerned. Next time it will be more difficult to convince them it is an issue (because "it wasn't in the past").

How can I impress the importance of security to my bosses?

You can't. What you can (and definitely shoud do) is make a written risk assessment and make sure your bosses read it. In it, describe the security risks, what (reasonable/affordable) actions can be taken to mitigate each risk, and what is the cost of not taking said action.

Example:

risk: server broken into, from the outside
probability: high (see statistics of compromized
    non-patched servers, at http://example.com)
cost: client financial records compromised (along
    with company credibility and public image),
    **loss of sales**
recommended action: keep servers up to date
   (requires 1 man-hour every two days)

risk: fire into the server room
probability: low
cost: loss of business and all backups
recommended action: update backup policy (requires 4 man-hours and the server offline)

risk: compromized company records
probability: ???
cost: compromized employees financial records
recommended action: restrict database access to X, Y and system administrators
    (requires 1.5 hours, best done after work-hours)

This way, you have brought the issues to your manager's attention, and it is up to them to take a decision (or not).

If you provide a written assessment, it is more difficult to ignore, and in case something happens, you are legally covered (your manager cannot say afterwards "but you're the security expert - it was your job to make sure this didn't happen).

Answer 2

As Jan Doggen has said in the comments, fixing these issues in your own time is not a good approach. You need to explain to your bosses what is at stake if security issues are not resolved.

Firstly you have to impress on them just how many people out there are dedicating their time to breaching security for profit. Often people ignore security issues because they think that it is unlikely that this will ever affect them.

Secondly you have to provide scenarios for each case for what could happen if you don't fix it and someone does get in. Consider the affect on the customers, the time it will take to remove any problems and as a result of these combined the potential losses to the company. People tend to sit up and take notice more when you bring monetary values into the discussion.

If after this you can still not make them really care about the issue then you can either give up or find people who do. Many voices are heard more than just one.

Or am I just being paranoid here?

It depends partly on the vulnerabilities you are trying to address. In the case of SQL if there's any risk of confidential data being accessed or databases being dropped it's obviously a fairly major concern. You also have to assess if your job is at risk if something does go wrong - how protected are you if you prove that the managers prevented you from fixing the offending security problem?

Answer 3

Sorry, not enough rep to add comments to the already excellent answers.

Here's a few things that might help:

1. Demonstrate how easy it is to break.
   • Especially if you've got a version of something with a known vulnerability.
   • Obviously, do this in a canned environment ;)
2. Point out that the world is changing.
   • remember the Target and TK Maxx hacks over the past couple of years? Both of these companies got sued by world+dog (mainly the banks/credit-card companies) because they were shown to be negligent.
   • Yes, failing to update your software which has known issues is considered negligence.
3. When they say "yeah, but it won't happen to us", say:
   • If the lock on the office door was faulty, would you leave the office unlocked over the weekend?
   • Security holes in software is like having a broken lock, except that instead of having to come into the building to steal our stuff, it can be stolen from anywhere in the world.
4. When they say "well, we'll just fix problems as they arise", counter with:
   • Okay, but that's the expensive way of doing it.
   • By being reactive, we'll be subjecting the business to unpredictable costs and disruption - it means that you're pulling people off their normal work to fix stuff as-and-when, which is going to threaten project schedules, or you may be forced to do a major upgrade or hire-in an expensive consultant to backport a patch for unsupported software.
   • If we are proactive, we can make updating a day-to-day activity that minimises disruption, because it's all part of the plan, yes, we'd need to invest a little to change the way we work, but that can be planned into our work schedules in a predictable way.
   • Reactive == costly + disruptive (i.e. doubly expensive)
   • Proactive == costly

Security is expected by customers and your suppliers, but more importantly, by the courts.

Answer 4

Mitigation instead of prevention

If security is explicitly and intentionally given a low resource priority (as evidenced by the response to your efforts), then you should target the level of risk reduction that you can achieve without spending much time or resources.

The practical level of risk is not so much related to the technical security of the systems. The core concept is [sum over various risks](chance of bad stuff * damage caused by bad stuff). With limited resources you won't be able to reduce all of the risks, or even to investigate and acknowledge them; however, you can take steps to mitigate and limit the damage if/when a security breach occurs.

Simple good practices will take you most of the way there. Ensure that you have multiple current backups (including offsite and offline) and a practical, periodically tested ability to quickly/cheaply restore data and systems. Ensure that your e-commerce system doesn't store any sensitive data that's not absolutely necessary - no credit card data (outsource it and the PCI DSS compliance to someone who can do it well), no unhashed passwords, no personally identifiable data on test systems, etc.

If that's properly handled, then your example with test VPS server becomes trivial - will extra 2 hours of maintenance downtime save us 2+ hours of hacked-server downtime over the next year? You should have an estimate of downtime-per-incident from your backup procedures and an estimate of hacked-servers-per-year from history, assuming your security practices are mostly the same level. And yes, it does imply that if that particular system is semi-disposable (can be recovered by spending half a workday or less and no other damage) and your systems haven't been hacked in the last two years, then many time-consuming security activities would actually be overkill for that system.

Answer 5

There may be two separate problems happening here:

1. Convincing your boss that security is important

2. Convincing your boss that putting time into some task addresses a security risk.

Most of the time bosses will agree with #1 in principle, but don't understand #2. If your boss does not agree with #1 even in principle, I would honestly be really concerned that you will not be able to convince him, but I would try to appeal to the fact that emergency fixes for security breeches will cost the company more money than just doing preventative work.

Make sure you don't get too technical. For instance, one approach to #2 for your particular problem, point out to your boss how Windows tells you constantly that you need to update all the time, or else you'll have a security risk, and that servers are no different.