41

We've been dealing with a credit card number scraping problem on our website for a couple of months. Proper authorities and card processors and card holders have been notified.

I have evidence which points to a co-worker being the culprit. I am not his boss, therefore do not have the authority to take action other than informing, but I am the SysAdmin and have the, albeit circumstantial, evidence.

The evidence is strong, but circumstantial, not direct. I have closed all the holes he took advantage of except some reliance on our boss being known to use the same password in different contexts.

How do I handle the situation? I want to present this to my boss, but when I previously alluded to this suspicion, she shrugged it off. She thinks that if I set up the security protocols well enough, then it doesn't matter that we have a thief working in the office.

  • 17
    What country is this in? Does the suspect in question have an at-will contract? Seems like this is not only grounds for instant termination, but also likely involvement of the police. – binarymax Feb 23 at 17:06
  • 3
    @binarymax Yes, we work for the same company. We're in the U.S. But yes, I also thought police but at the same time...i don't want to fubar this kids life it i'm wrong...people are convicted on circumstantial evidence every day, but idk...I guess we're diving into morality now lol – lemonskunnk Feb 23 at 17:28
  • 3
    Why is no one telling the police? Credit card numbers were stolen already! – jcmack Feb 23 at 18:15
  • 2
    @Felix I assure you, credit card theft happens ALL the time, we are PCI compliant. Also, read comment above. – lemonskunnk Feb 24 at 13:00
  • 1
    @Konrad Not really. Most evidence is circumstantial, that doesn't mean it isn't strong. – IllusiveBrian Feb 24 at 20:18
66

You go to your boss and say, in this order:

  • I have locked everything down so that an attack like that will not happen again
  • Insider attacks are always harder to defend against. For example they might take advantage of knowing some of us use the same passwords for several things. Practices that are perfectly safe against outsider attacks can leave us vulnerable to insider attacks
  • If you want to investigate the source of the attacks, I have quite a lot of data gathered already and can look into it further if it's important
  • I am personally convinced precisely who it was, though I couldn't prove it in a court of law. Let me know if that's something you want to pursue.

These are the things that matter to the boss. The direction of the conversation after that is up to the boss, not you.

The reason for this order is so that the boss can wander on a tangent or end the conversation at any time and the most important stuff was still covered. So after the first sentence, the boss may just say "good job, thanks, bye now" and you at least led with your accomplishment. After the second sentence you have mentioned that this wasn't a general failing to protect from strangers, but at most a minor flaw in your preparedness, and planted a seed about just who it is that reuses their passwords like that. The last two sentences have specific prompts for the boss to tell you things because if you've been allowed to say this many sentences, you're not getting shrugged off and can ask for authority to investigate and report your findings.

As suggested in the comments, repeating this information in writing is probably wise. Start with "as we discussed today" and quickly summarize whatever you managed to say in the conversation. Then if there are things you didn't get to, include a segue like "you should also know that" and add your extra information. Keep it short enough that you don't need to rely on other people to summarize it later if you end up the topic of discussion a level or two above you. (One or two sentences per point, as in my bullets, I suggest.) Offer to meet again to discuss any of this in more detail if that should be needed.

Keep a copy of this email somewhere else; for example forward it to a personal email account if that's not a violation of company policy. Print it and take the copy home, despite that being a super easy thing to forge at your leisure later. If you know the date and time, subject line, etc (which are on your printout) the company can probably find the email in a log somewhere, which is not so forgeable.

  • 3
    Yeah, that is pretty much the opinion I've come too as well. However, after having been shrugged off so many times, I feel like the street corner guy with the cardboard sign saying "The End Is Near..." Thank you Kate, Appreciate the reassurance. – lemonskunnk Feb 23 at 17:17
  • 10
    @danFbach If you haven't already, I would document this in an email in some way. Email what you found, what you suspect is going on (in a generic way... stick to what you can prove), and what you did to prevent it. I wouldn't mention names, unless you are going to list all the people that were connected at the time it happened, etc. My concern is that at some point what happened is discovered by someone else with more common sense and security knowledge and it might come back to bite you. At least if you sent the email, you can say I let my boss know and her response was X. – JeffC Feb 24 at 0:15
  • 2
    @lemonskunnk Sure. I would suggest something very informational, non-confrontational. "Just to follow up with all the conversations we've been having, I found A, B, and C. I implemented D, E, and F to correct the issues." and so on. – JeffC Feb 24 at 15:57
  • 2
    You've suggested that a paper copy be taken home, but are concerned that it might be considered forged at a later date. If you're looking for a way to prove the existence of a document by a particular time, the easy step of sticking it in an envelope and snail-mailing it to yourself can easily establish a date on which it existed. Just be sure not to open the letter prior to needing it in court, or under the observation of someone who can swear to the contents that were in the postmarked envelope. – Makyen Feb 25 at 0:34
  • 1
    I'm not concerned it might be considered forged: I explained how just keeping the printout would ensure you could have info that can be verified in logs or whatever later. I think using the "poor mans copyright" approach is overkill here. – Kate Gregory Feb 25 at 0:35
43

The kid is the minor of the problems your company has. The kid can easily be dealt with. The boss shrugging it off is the more major liability here.

Your company is dealing with credit cards. Dealing with credit cards comes with a whole list of regulations. Which includes promptly dealing with security issues. Your company probably does not want the credit card companies refusing to do business with you.

If your boss is shrugging it off, you go to her boss.

  • 2
    yes, I am aware of PCI regulations. I'm also aware that credit card scraping happens everywhere, from fortune 500 to mom & pop shops. We follow regulations and our set up is quite secure - My superiors just didn't believe an attack could come from within which is why they resisted sec protocol changes. Finally this week, I chose to disobey and enact them. I caught some grief, but they're still in place. – lemonskunnk Feb 23 at 17:35
  • 4
    TBH it sounds like the setup of the company you describe is a shambles. When you say "Even Petco has been attacked!" that is because they made mistakes within a mature, professional setup. In contrast, it sounds like this current company is a dumpster fire. You should go work somewhere better. Get more money, too! – Fattie Feb 23 at 17:52
  • 1
    @Fattie lol.....couldn't have said it better myself. literally, 100% on point. – lemonskunnk Feb 24 at 15:09
6

You go to your boss, tell them everything you have, and the boss makes their decision.

There is no "innocent until proven guilty" here unless your boss wants to take the scriptskiddy to court and then to jail. The boss has in my opinion no choice other than firing the kid.

  • Thanks, I'm of a similar opinion. Though, firing is not my choice to make. And lacking true "Digital Fingerprints," I do hold some reservations about making my case. – lemonskunnk Feb 23 at 17:18
  • 2
    @lemonskunnk Do however document and retain everything. If things escalate and people are trying to find out what your boss knew when, you may get thrown under the bus. – ColleenV Feb 24 at 15:45
  • Again, ridiculous. There is always innocent until proven guilty. Maybe suspend on full pay pending an investigation but firing someone based on weak evidence is immoral. Circumstantial evidence is weak by definition. – Persistence Feb 24 at 21:01
-6

Talk to the kid and ask him if he knows something about it. You don't have to get an honest answer. Your question will lead to a reaction on his side. He might change the form of the attack accordingly or pause for a while or even stop.

  • 3
    If you had read the longer version, you would have read that the kid was asking about the changes already... – Solar Mike Feb 23 at 19:53
  • Thanks mike, and asdf, I also have been considering asking him to see a reaction, but the uncomfortable/awkward questions he was asking is what made me look at him in the first place. – lemonskunnk Feb 23 at 20:04
  • 3
    I can imagine that this could get you in trouble, as you'd be effectively telling the suspect that they are a suspect. It could taint further results. – forest Feb 24 at 6:01
  • Well, if it's a script kid it is important to keep him busy thinking about possible consequences. If it is a real coder - bolster your defenses and tell him that there is an investigation going on. – asdfsafd Feb 24 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.