7

You're a code monkey. Your CEO stubbornly insists on a partnership with another company that potentially exposes customer financial data to hackers, and wants you to incorporate their product into your software.

The vulnerability exists in the first place because the other company's self-styled "security consultant" is demonstrably ignorant. You've already described in detail to the CEOs of both companies how the attack could be carried out, and how the "security consultant" is wrong. You've dumbed it down as much as you can and provided links to the technical explanations. The execs have stopped short of acknowledging that the risk actually exists, or that it could be mitigated very cheaply.

Has your obligation to your own company's customers and investors been fulfilled? If not, what should your next step be?

To avoid opinions or legal advice:

  • Are there any government or industry guidelines regarding the risks and benefits of industry standard vs. "clever" DIY encryption schemes (similar to the guidelines regarding the use of SSNs in this answer) that can help bridge the gap between a programmer and a non-technical CEO?
  • Are there any government or industry watchdog agencies that whistleblowers can turn to in this kind of situation?
  • How would an employee obtain legal guidance on these kinds of issues? The company has no legal department, and outside lawyers are apparently only interested if you've already been fired or sued.
  • 1
    Do you have a legal or compliance team within your organization? It might be best if your executives hear the consequences of the problem from a professional. While you may be a professional when it comes to analyzing security risks. The consequences of breaches to those risks are best described by a legal or compliance professional. Additionally, what industry are you in? – SQLSavant Feb 27 '15 at 21:53
  • @cloyd800 The company has no legal department of any kind. Part of my question is how to make contact with a legal or compliance professional, both to "do the right thing" and to cover my own butt. – The Merry Misanthrope Feb 27 '15 at 22:24
  • 1
    Have you tried the non-technical approach, i.e. explaining how expensive a data breach could potentially be to the company? I think you could make a pretty good guess based on the data from the multiple, very public data breaches of the past couple years and your intimate knowledge of the product. That may make the CEO's assessment of the risk that you're correct and the security consultant is wrong skew a little differently. – ColleenV parted ways Feb 27 '15 at 22:31
  • @ColleenV The trouble is that I really have no idea how those costs are determined. The only natural consequence would be a difficult-to-quantify loss of trust. All other potential consequences are arbitrary and understood only by lawyers. – The Merry Misanthrope Feb 27 '15 at 22:36
  • 1
    Well one thing the companies that were breached did was provide free credit monitoring for all of the potentially impacted customers - that's one quick place to start. I'm not talking about lawsuit settlements, I'm just saying spitball how expensive the measures would be to recover from an incident. You'd have to patch the hole, do some sort of audit of customer data, etc. That's expensive even if you don't get sued. – ColleenV parted ways Feb 27 '15 at 22:39
3

You don't have legal obligations to 'your own company's customers and investors'. You aren't a 'licensed engineer' -- for better or worse, us code monkeys don't have that. You aren't an officer of the company.

What you have is your own conscience. Only you can decide how this sits with your conscience, the internet cannot. If your own conscience is sufficiently unquiet, you'll leave.

If your employer is in one of the very few areas where there's any corporate legal obligation to protect customer data, you might be able to blow a whistle with a regulator. Otherwise, you can whistle up the press, and thus risk whistling up legal action against yourself.

In defense of your management, there are many, many, ways to have a breach of customer data. Most of them start with employees clicking on cute cat pictures. It is possible for your management to have decided that the risk you've identified is less likely than the risk of social engineering. You can't deliver enough information here for anyone to judge. But you might consider that before riding off into the sunset.

2

If you haven't already done so, write out a clear memo to the CEO, and send it as an email (not as an attachment). Include in this memo the problem that you see, the areas of concern and offer 1-2 solutions to achieve the business goal without compromising the customer data. This way, you have documented your concerns, and offered a solution to the issue at hand.

It is critical that in this memo you stick to facts, and only mention things that you can prove without any doubt or assumptions. Also, do not offer any negative opinion about the security consultant or anyone else, and simply let their incompetence show through in the provable security hole.

You can end the memo with something like "I am concerned about the vulnerability this puts our organization in, both financially and perceptibly, and would appreciate the chance to have a one-on-one dialog with the CEO to explain these in more detail and understand his take on this situation."

If you do get a chance to talk to the CEO, and he shares his views, you may either get a chance to urge him to reconsider, or you might get convinced that this is not an issue after all.

Either way, you should make reasonable efforts (while documenting) to work this out internally. If it doesn't work, I suggest approaching a local attorney to get further guidance.

  • +1 for this, but I think it omits the last step : get your CEO to accept the risk. In writing. Concretely, make him send you an email stating "I read your memo and understood your concerns, I want you to integrate product xxx anyway" – ero Mar 3 '15 at 9:48
  • In my opinion, that acknowledgement is not really necessary. The CEO is accountable for all decisions made by the organization, and he doesnt need to explicitly state it for it to be his responsibility. The main idea here is to protect the rights of the employee who has concerns, and to establish a clear communication that can be referenced in future in case a negative situation arises. – dg3781 Mar 3 '15 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.