How to approach IT security and legal issues with unwilling boss?

Question

I am working as an apprentice in a very small company, and, although sizable amount of money and IP (Intellectual Property) pass by our company, IT Security and presence of legally obliged documents are nearly nonexistent and the boss is seemingly unwilling to do anything about it.

Some issues :

• All the passwords for the company are in a excel sheet and routinely sent over email that isn't protected well
• Although there is a web store there are absolutely no mention of the legal mentions (Privacy Policy, Sales Policy...) that are obliged in our jurisdiction ...

As an apprentice, I don't really see myself as legitimate (I do a little bit of IT on my apprenticeship, but not in the company infra, and I know nothing legal-wise) to bringing those issues to my boss (which is the CEO of the company), and seeing the whole picture that has been going for years now, that tells me that something like that will never be resolved even if brought up.

But I'd like to have that discussion with them, how can I approach that in a way that would not discredit me?

Answer 1

I have no experience with apprenticeships in France and I am sure the legal framework is different in it's details. But I will assume the basic principles are the same as in Germany.

As an apprentice, the fact that you don't know your job yet is literally in the job title.

You are not responsible for anything that goes wrong in your job. You are still learning. For your own safety and the safety of the company and customers, your work has to be double-checked by someone who does know the job. Every apprentice needs a master, otherwise it's not an apprenticeship, just a person with no clue fumbling around.

Your job is to be curious, to study and to ask questions if you don't understand something, in order to learn how to do the job properly.

So what can you do? Ask questions.

Hey, last week in school the teacher told us about those laws that cover the obligation to provide a privacy policy and sales policy to users. I found that very dry and theoretical, could I look at ours as a practical example? I tried to find them, but I couldn't figure how to access them from our website.

It's not your job to tell your boss that it's needed. But it is your job to ask questions to better understand your job. And that's all you did. If they don't answer or just hand-wave it away ("oh, our lawyer said we don't need one because we are exempt." That might be bogus, but your job is not to second guess your boss. They told you it's okay, so it's okay.) your job is done. You brought it up, the ball is in their court.

Answer 2

As an apprentice you don't have too much leverage to do something here. It would be different if you are the IT consultant of the company and it would be your job description to solve problems like that.

What you describe can cause big problems, and if murphy is striking, you want to have written proof that you aren't to blame. So formulate a nice and polite mail to your boss outlining the issues you see. Store the mail also on your private hardware, in case someone gets unreasonable and tries to erase evidence.

Don't try to pressure your boss, or give the impression you know more than him. After all it's not your job, and you only want to help and think ahead. If you have suggestions how to improve the situation, only give them when asked. You don't want to be seen "lecturing".

Afterwards, move on, it's not your problem anymore.

Answer 3

When I was hired on my first job out of university, I asked where I was supposed to work.

My boss started humming and saying that "well, we are a bit short of equipment right now" and so on, until I prompted "if really needed, I can bring my own laptop", to which the boss happily agreed (he was saving a few hundred euros in purchasing a new laptop).

After a couple of months of me being in that work with my personal laptop, one morning he rushed into the office, barking "nobody here is allowed to use their personal device, it's a huge risk for our IP", then looked at me in an accusatory tone "why are you using your own laptop here?", to which I replied "when I will get the company laptop I will be more than happy to leave mine at home". The next day I got my company provided laptop.

What had happened? While he was driving to the office, he had heard on the radio about companies being hacked by unmanaged devices and losing their IP.

You can try a similar approach, if you really want to do something about it: just collect some examples of damages caused by such behavior, and let them read through those cases: ransomware, malware, data theft, you name them. And even if you don't have IP sensitive info on your laptop, it can always be an entry point for the company network.

If they don't think the risk is real for their company, there is nothing you can do but following the guidelines, and try to document that the negligence came and was approved/caused from up above. Whenever some problem will happen, stay assured that they will try to dump the fault downstairs.