How to get the attention of operations manager as a junior?

Question

The software development company I work for has around 40-50 employees with about 12 of those being developers. I work as a junior developer and have been working for about a year after completing an apprenticeship last year. This puts me at the bottom of the rank in regard to making decisions about our main product. But in saying that I have noticed a very large problem with the security of our product. A cringe-worthy problem that could cost the company a lot of money if it is exploited.

I know that it is on my managers' radar as there are tickets raised but they are old tickets that look like they have been forgotten. When I first joined the company I mentioned the problem and he agreed it needed to be fixed but didn't say much more than that. This makes me want to take things into my own hands for my own protection of keeping it from being exploited and losing a job because the company has to pay a fine.

How could I get the attention of my manager and potentially his manager and show them how much of a risk it is to not fix this security problem? Please keep in mind that I don't want to this to seem like I'm going above my manager to get my way, I have a good relationship with my manager at the moment and would hate to ruin it with something like this.

Answer 1

Going over your manager's head is often a seriously career-limiting move, and to be honest if you go direct to the operations manager on this then I'd fully expect your manager to see it that way so you need to work with him on this.

Your best approach is to raise it again with your manager directly, if you have a suggested solution to the problem then try and phrase it as if you're doing him a favor and suggest that your solution could be a way of avoiding it coming back to bit the company (and him!) in the behind later:

Hi [manager], I've been thinking about the security issue from ticket 1234 and I think I've got an idea on how we can fix it and it would be good to have a discussion so we can see if we can sort this before it gets exploited which would be very costly/embarrassing for us.

Not the use of the word "us" - you aren't implying that he's the one who'll get it in the neck you're implying that you're a team. It's subtle but it does help.

If for some reason your manager keeps pushing back on this with you I'd suggest going to the next most senior member of the team/department (i.e. the person just below your manager) and discuss it with them, see if there might be history you are unaware of. And if there isn't then they may be a substantial ally - firstly because there will now be two of you in the issue, secondly they will likely have their word carry more weight with your manager because of their seniority and finally it's relatively safe because they aren't over your manager so you aren't going over his head.

Also, and I cannot stress this enough, you must do communication on this with your manager by e-mail - in the worst case where he does nothing or actively rejects your attempts to get this issue resolved and it then get's exploited your behind is sufficiently covered.

Answer 2

It doesn't seem like you are taking into consideration the current tasks that are prioritized higher than the security issues. Look at what you are currently being asked to do and get some feedback on why they are so important. Even if you didn't have the security flaws, you should still know this. Learning to respectfully ask why is important to your development as a programmer. Make sure they understand you're not trying to get out of work, but want to see the "bigger picture." Sometimes you have to use a buzz-word to get their attention.

Who knows, you may learn that if you don't get the next release/patch out, your largest customer is going to drop your product which may force the company to close. Most decisions have a risk involved. You need to understand the risks behind the current decisions.

Answer 3

I work in the IT Security profession as an IT auditor and your current situation is something I frequently encounter and sympathize with. What I have found helps is to have hard data about the vulnerability you see, its impact to the company if exploited and the threat actors most likely to be able to exploit it.

The nature of the vulnerability you found

Describe the nature of the vulnerability you have found. Facts such as the below are useful to include in your analysis.

• How the vulnerability can be exploited - MITM, remote access, user impersonation etc.

• Conditions that need to be met for the vulnerability to be exploitable such as unpatched systems, systems using a broken protocol etc. (e.g: TLS 1.0)

The impact to the company if vulnerability is exploited such as below:

Describe what negative events can happen if the vulnerability is exploited.

• Financial penalties in the form of fines and customer lawsuits
• Loss of market reputation if the vulnerability exposes customer data
• Loss of future customers due to the degraded reputation

Describe the threat actors most likely to exploit the vulnerability and how likely each threat is. See examples below:

• Terminated employee
• Black hat cyber criminal
• Competitor firm

After gathering this data, you should be able to go to your manager and use this research to quantify the severity of the vulnerability. You may also want to look into a standardized vulnerability scoring system such as CVSS.