17

Recently, our company (Dutch) got acquired by a bigger company (Indian) and consequently, our company had to switch over to the acquirer's IT ecosystem. Some parts of the acquirer's system are badly outdated and do not follow best practices for security, creating vulnerabilities.

Despite expressing our serious concerns regarding the risks these limitations bring and the likely security issues and abuses they cause, the team responsible for maintaining these systems (based in India) have not adequately remedied these problems.

Recently I found a major vulnerability that could seriously compromise corporate systems, including my own personal data as stored in these systems.

I have all the proof needed to prove the vulnerability, but given how the bigger corporate treated our last request, what would be rational thing to do? Obviously, quitting doesn't solve any problems, as my data and information are staying in their systems for at least two years after my termination.

Edit: I must emphasise that I have NOT broken in the system. There are other ways to prove the existence of this vulnerability.

0

7 Answers 7

17

what would be rational thing to do?

Report your findings to the company's security officer. If they do not have one, then report to whomever is responsible for the vulnerable systems. Unfortunately, you can't force them to act. So if they decide to do nothing then your data will still be at risk.

If they do decide to do nothing then I would report this to whatever government agency oversees data privacy in your country as well as the country of the parent company.

There is one caveat, though. If you knowingly broke into these vulnerable systems yourself just to prove that they were vulnerable without the explicit permission of the company or you broke into the systems in a manner which was unrelated to your role at the company, then you could be in big trouble. I don't mean that you may get fired by the company, I mean that depending on your location you may have broken some laws and are at risk for legal trouble including incarceration.

5
  • 5
    The acquiring company is definitely bigger than 1000 employers (as implied in the question). IF the company does not have a security officer - along with the security issue, would you recommend to stay at such a company? (for me that is a colossal red flag)
    – kedavle
    Aug 12, 2022 at 4:23
  • I would report this to whatever government agency oversees data privacy in your country as well as the country of the parent company. I would be careful there, there may or may not be an obligation for reporting such issues and one can be in trouble for that. The first part of your answer is very good, though. This is a different story is OP's personal data is at risk.
    – WoJ
    Aug 12, 2022 at 14:11
  • 1
    I think the "Leidraad Responsible Disclosure" from the openbaar ministerie (Dutch public prosecutor) combined with whistleblower protection laws (Wet Huis voor klokkenluiders) could shield the OP from retaliation and legal issues, if their company has an internal or external Coordinated Vulnerability Disclosure policy. Aug 12, 2022 at 15:06
  • Without such a CVD policy from the company, the instruction still applies, but then it requires more investigation to ascertain it is responsible disclosure/ethical hacking. Aug 12, 2022 at 15:14
  • 5
    As a dutch, you can actually use GDPR. The employer must keep PII safe, and that includes using state of the art security measures (in german, the legal term would be "stand der technik") for the PII of employees (like their name etc).
    – Polygnome
    Aug 12, 2022 at 17:15
4

Obviously, quitting doesn't solve any problems, as my data and information are staying in their systems for at least two years after my termination.

Just to pick up on this specific point: while quitting itself doesn't solve the problem, exercising your right to be forgotten after quitting does.

8
  • 2
    in india? (GDPR is European Union)
    – kedavle
    Aug 12, 2022 at 4:18
  • 11
    @kedavle Dutch company. The fact that an Indian company bought them does not mean that they suddenly don't have to follow Dutch and EU regulations.
    – Frodyne
    Aug 12, 2022 at 6:39
  • 3
    IANAL, but as long as the the former employee has the right to file a claim against the company regarding their employment (missing wages, discrimination, etc.), the company has a legitimate interest for keeping the employee's data in their systems to defend against such claims. Thus, the "right to be forgotten" might only help once the period of limitation for such claims has passed.
    – Heinzi
    Aug 12, 2022 at 7:27
  • 7
    @Frodyne Ever more than that - any company which does business in the EU and keeps data on EU citizens is subject to the GDPR, even if they are not EU owned. Aug 12, 2022 at 7:36
  • @Heinzi Once the right to be forgotten has been invoked, the burden of proof moves to the company to justify why they need to keep the data. While they can possibly justify that for operational data, it would be very hard for any PII. Aug 12, 2022 at 7:39
1

Follow the advice below only if you strongly consider the vulnerability you found critical and you cannot, in good conscience, continue to work with people that refuse to fix it. IANAL.

Send your vuln (with an example of exploit if it's not breaking any company policies, the Rules of Conduct or any local or international legislation). Wait 2 weeks for it to be fixed.

If not, prepare your resignation and ask the company to remove all your private data as you remove your consent to store, process it or share it with others as per Europe's GDPR regulations right to be forgotten. Do note that some data cannot be removed if it's used to comply with a legal ruling or obligation or if it might be used in a legal case.

Contact the Data Protection Officer in your company (they are obligated to have one) and ask him to take note of your request if they do not respond within 5 days.

If your employer does not respond within the legal timeframe in your country (mine is 30 days) you should be able to contact the Dutch Data Protection Agency and request a consultation about your situation.

Either way, if they refuse to plug the gaps and answer your lawful sensitive data removal requests, prepare to leave.

Keep a written record of all your actions, emails, interactions with company officials etc on your person, away from company email servers or any company property such as laptops, phones etc in case access to such resources is removed by your employer and you need to prove you acted in good faith towards your employer.

0

I'd echo @sf02 answer first in reporting to security officer. Depending on your company organization you may also be able to report it to a C level exec who may be concerned enough to force action on your findings.

An alternative is to report the bug through a bounty program. For example Microsoft has its own bounty program where you can report bugs/security flaws with their software (M365, active directory). Not knowing your company but hackerone has several companies that offer bounties for security flaws and can help you contact the appropriate parties if the company isn't registered.

0

what would be rational thing to do?

So you want to maximize benefit and minimize loss?

Talk your manager and their boss and convince that this is a problem. Then send a mail to the top guy in your org and ask for a meeting to discuss "something sensitive". Keep your immediate management chain in loop. Let the suspense build.

In the meeting, present your case, as though you are a startup presenting to a VC.

Wait a month. If nothing happens, cut your losses and get out of the company. If it gets fixed, or if you get invited to more meetings to oversee this issue and possibly get promoted into bigger corporate security roles, enjoy. If all this is too much of an effort for little gain to you, send a mail to your manager with the details and forget about it.

0

Raise this issue internally to your security officer or technical officer. If there is a system in place to make bug reports, use it too. Whatever you do, try to cover your ass. Most importantly, do not do anything illegal.

Is any other data accessible through this system, like customer data?

If your company does not want to resolve this issue, and they get hacked and data is leaked, they might end up being fined by the autoriteit persoonsgevens (Authority Personal Data). Especially if the company was aware of these vulnerabilities.

-1

"Your bank is insecure and to prove it I broke in" is probably not the best approach to having your concerns taken seriously. Reiterate your original concerns and if they still take no action then let it go. The responsibility is not yours.

2
  • 2
    For clarity, I have added a paragraph to my question, emphasising that I have NOT broken in to the system, but I have proof that there's a vulnerability making it possible.
    – Kinen
    Aug 11, 2022 at 19:14
  • 5
    You may not have broken in, but your testing may be seen as tampering. I'd recommend caution on your part. You've already voiced your concerns, your attempt to provide more evidence may cause trouble for you.
    – joeqwerty
    Aug 11, 2022 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .