83

I work for a small consulting company with no formal IT personnel. One other employee and I are the only ones who actually care about information security and network management. We both get a ton of resistance when we try to spend time on improving security because it is not directly billable.

I just discovered that the security policies that the directors advertise to clients and use to acquire all of our business don't even come close to reflecting how we actually operate. Is there anything I can do other than jump ship?

I am rather inexperienced in this side of things as I am primarily a developer still trying to make my break into the security industry. Being one of two primarily 'responsible' for the network now, am I at any personal risk?

migrated from security.stackexchange.com Jan 19 '18 at 16:24

This question came from our site for information security professionals.

  • 1
    Comments are not for extended discussion; this conversation has been moved to chat. Please edit updates into the OP and use the linked chat for discussion/commentary and the Answer box for answers. – enderland Jan 21 '18 at 17:49
  • Lots of different advice in the answers, but what it really comes down to is: What is the worst that can happen if the lax security attitude becomes real and something is breached? Do you do front-end web development and—maybe—someone sees source could to a plug-in? Or do you run an e-commerce platform where financial data is at risk? It all comes down to how bad would a breach be. And if this is a company that deals with financial and other sensitive data, then yes… You need to get out before you are made a “patsy” for a breach. If not? Sorry to say what you describe is more common than not. – JakeGould Jan 21 '18 at 20:54
  • 2
    Keep in mind it depends a lot on what exact rules govern what the company is supposed to be doing: if the company deals with HIPAA regulations, run. If the company is in a non-regulated industry and it makes mostly spurious claims as part of marketing materials (like that it runs virus scanners on linux servers) then legally it is being creative with facts. Which at that point is just an ethics issue not a fraud issue. – Aaron Harun Jan 22 '18 at 13:05
93

If there is a widespread fraud (which is exactly what is happening here from how you describe it) then eventually one of your clients will figure it out, and the will subpoena anyone that works on these projects. I would personally seek legal counsel at this point. You sound like you're in a bit of a legal situation that needs the guidance of a professional that you can talk freely to and that can help guide you through this.

  • 21
    It should also be of note that the longer you stay in, the harder it is to have any sort of plausible deniability. Just think of all the people who knew something for years, and never said anything, and those guys get into big trouble as well. If you know now, then it's time to speak up now. – Dan Jan 19 '18 at 17:31
  • 19
    I'm going to go ahead an mark this as the answer since I kind of suspected this would be the case. Luckily for me I just became aware of the extent of dishonesty as the 'policies' are locked behind a confluence page that requires management roles so general employees are unable to see them. I was given them two days ago out of necessity because they needed someone to write a Business Continuity Plan and I told them I needed any current documentation as a starting point. – NetworkMonkey Jan 19 '18 at 18:29
  • 53
    @NetworkMonkey For future reference, refusing to show employees what they show to potential customers would, to me, be a huge red flag. – KRyan Jan 19 '18 at 19:10
  • 8
    To honest, I doubt there will be any subpoenas issued. As clients discover the fraud they will quietly cancel/not renew contracts and business will slow down w/out litigation. – emory Jan 19 '18 at 20:54
  • 20
    @emory It depends a lot on how the fraud is discovered. If a data breach plasters the clients customers data all over the web, lawsuits become pretty likely. Worst case it was some kind of legally protected info and the government gets involved. – mbrig Jan 19 '18 at 22:49
64

Is there anything I can do other than jump ship?

Nope

You need to jump ship ASAP as it appears your company is engaging in fraud and will at some point be found out. And as an added bonus they may be able to leverage the blame your way. You pointing it out won't do any good as you have already discovered.

As far as hiring an attorney, I really don't see what that will get you other than a big bill. You could look into some free anonymous whistle blowing techniques, but again be very careful that you are not discovered,

Short answer: Time to get the resume up to date and move on.

  • 29
    There are few times when "Just quit" is the right answer, but when your employer is engaged in deception and fraud as a regular business practice ... Yeah, jump! – Wesley Long Jan 19 '18 at 16:42
  • 8
    There are reasons one might not want to reamain anonymous when whistle blowing, attorneys are good at helping navigate such instances. Also, attorneys are good at helping you avoid breaking the law when you do engage in whistle blowing. Lastly, the OP may already be in legal jeopardy, determining if that is the case might be helpful. Simply - attorneys aren't useless in this circumstance at all. – Glen Pierce Jan 20 '18 at 20:48
  • 3
    This must be US specific. In germany, you basically would be obliged to inform the Attorney General of Fraud. And, interesting enough, no private paperwork will be valid that prohibits this. – TomTom Jan 22 '18 at 9:38
  • @TomTom It is, as the question has a USA tag attached to it. – Mister Positive Jan 29 '18 at 13:13
22

I am an IT auditor who has experience assessing security controls at service organizations, like your company seems to be.

Being one of two primarily 'responsible' for the network now, am I at any personal risk?

In all the attestations I have done (SOC 1 2, 3 AUPs), the client and service organization / vendor had a contract that is usually signed by senior management of the client and service organization. Establishing internal controls at a company is ultimately the duty of management and unless you are a member of senior management, you are unlikely to be held responsible by the client if the controls are fraudulently misrepresented.

Is there anything I can do other than jump ship?

For what you personally can do, there is nothing much like other answers have said. Therefore I agree that the best decision for you is to leave ASAP. There may be a possibility in the long term for positive change, but given what you stated about management, I doubt thee will be serious improvement in the IT Security stance of your company because Management simply don't care about internal control.

I would not be surprised if improvement, assuming it takes place, will be customer driven in the form of vendor due diligence reviews or SOC audits demanded by new clients before they will consider doing business with your company.

As of right now, if a customer were to require a SOC 1 / 2 (depending on whether service affects customers financial reporting), your company would most likely receive an adverse opinion. In other words, the auditor would conclude based on the lack of reputable evidence that the controls as specified by your company management, as being in place, are not designed or operating effectively. For example, based on what you wrote, there is no way that SOC 2 control objectives regarding Communications are being fulfilled.

As an aside to your question, below are just some additional suggestions for you.

Forget about adopting meaningful information security controls until those those security policies are unlocked and made available to all employees

For information security program at a company to work, all employees must actively participate. They can't do so if they don't know what is expected of them. For example:

  1. What should an employee do if they suspect a security incident?
  2. How should they report stolen assets such as laptops?
  3. If there is no requirement on periodic security training, are employees knowledgeable about attacks that target human weaknesses such as social engineering?
  • 2
    "their" should be "there" right at the end of this answer, but I don't have the reputation here to make small edits. – a CVn Jan 20 '18 at 11:48
14

What follows is dark stuff, and I am neither a lawyer nor involved with any business handling it that way.

Be aware that sometimes the difference in theory and practice regarding security policies is informally mutually understood - there are cases where it is the client wanting such policies on paper, probably because THEIR clients want it to look that way on paper, while being very much aware that they cannot get it in practice at a given price point. That game is sometimes played up a food chain of client's clients.

Be aware that costs spent on security are often seen as uneconomical if they are not below ((expected cost when something goes wrong)/(perceived likelihood it goes wrong and you can't make someone else pick up the tab)).

The risk in such practices is that a client might be calculating on being able to outsource the blame to your company if something happens.

The important question for you is: Can you, as the person responsible (to the company) also be held accountable (to outsiders)? This is rather dependent on local law. I am no lawyer and cannot comment on that.

Also it could be important to make sure that your employers management is aware that you, responsible or not, are a) not implementing the formal policy in practice and b) are not told by the accountable person to implement it. If you can gather any proof (eg emails) that would make that clear, do so. If you need to ask explicitly to get it in writing, do so in a non confrontational way that doesn't imply you have a reason (eg knowledge of what the customer was told) to consider current practices insufficient - rather ask whether management wants you to change anything regarding security practices.

  • 1
    Very true. However the OP seems to be more concerned about the reputational risk, and secondly maybe civil liability. Criminal liability sounds remote. – smci Jan 20 '18 at 18:00
4

Might be a long shot given your description of the company... but you could whistleblow, either internally (to HR) or externally (a lawyer).

There's some useful advice on https://www.gov.uk/whistleblowing to report wrongdoing:

You can tell your employer - they may have a whistleblowing policy that tells you what to expect if you report your concern to them. You can still report your concern to them if they don’t have a policy.

There are other options if you don’t want to report your concern to your employer, eg you can get legal advice from a lawyer, or tell a prescribed person or body.

Edit: If you do go down this route, then there's a good chance the company could be shut down. So, whatever you decide to do, it's time to jump ship.

  • 1
    He's the only Dane Ver – Vivek Chavda Jan 19 '18 at 22:10
3

just discovered that the security policies that the directors advertise

Ask your directors about this.

You make it sound so black and white. And, maybe it is. However, I know a lot of younger workers may be quick to jump to a conclusion like this, without it being right.

Perhaps the directors are implementing certain security practices that you're fully unaware of. For instance, maybe you don't see certain security implemented on a workstation. However, maybe this is being implemented in a firewall. Or maybe network traffic is being scanned by a third party company, using a "cloud" service, before the traffic even reaches your site's outermost firewall. Or maybe the service is being implemented, but only on one computer (a main "server", e.g. in Active Directory this could be a Domain Controller) and is not being implemented in other computers. In all of these possible scenarios, the directors may be innocent.

Or maybe this is an oversight from something that was implemented, but then the implementation was discontinued but the advertising was never updated. (Or maybe the advertising was updated by some marketing/advertising person who made fresh advertising based off of a feature list, and it is just the feature list that didn't get updated.) In this case, something maybe wrong, but if you come out with swinging fists then you could easily make enemies, whereas asking how something is implemented could result in the directors seeing a problems and deciding to ally with you in efforts to do something that was previously seen as being unnecessarily expensive. The same situation could result in an enemy or an ally, based on how you handle it.

So, to Summarize:
If the company is, in fact, being unscrupulous as your question suggested, then there are plenty of other answers providing solid (challenging, unpleasant, but right) advice. However, before starting any fights or taking extreme actions like jumping ship, make absolutely certain just how bad the situation is. Then, talk to them and ask them about existing plans to make situations right, or if we can start making such plans immediately. If they cooperate, you're ending atrocities and making the world a better place. If they don't, at least then you can have confidence that you did what you could to try to correct situations before leaving a toxic situation.

  • Upvoting this because it's the only answer that doesn't make wild assumptions that the world is full of evil people doing evil things at all times. Agree that the best course of action is to just have the conversation directly with the directors. THEN, prepare to jump ship if nothing is to change. Assume innocence until you can prove otherwise. – Rawrskyes Jan 29 '18 at 6:01
1

You could be in a sticky situation. You need to differentiate between your and your company's deceptive practices. If you jump ship, the company could blame you for not doing stuff and then leaving. I recommend you talk to your manager about this. Are they complicit in this lie, as well? If possible take written notes after the meeting.

Put forth your concerns, and lay them all out. What is managements reaction? If they do not wish to take your advice on action to take, politely resign, as this is not the sort of company that will help further your career.

  • 1
    Read this first: expertpages.com/news/taping_conversations.htm – Wesley Long Jan 19 '18 at 18:32
  • 6
    The laws of recording a conversation vary state by state. This could be dangerous to the OP. – Mister Positive Jan 19 '18 at 18:38
  • 1
    I took "recording the meeting" to mean document it. Have an email trail that can be used to show the meeting happened, and summarize the meeting and what was agreed and also put that in an email. – Thomas Carlisle Jan 19 '18 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.