I started working at my current workplace - which is private educational institution in the UK - about 6 months ago. I am quite advanced PHP developer and have about 5 years of work experience. However, despite being 23 years old I am currently a student in the given organization (almost finishing), I was invited (or requested more or less) to work for them full time on the Virtual Learning platform they ware developing, without me looking for a job (I had dedicated my time to being a student there and was supporting myself just fine). At the end of the interview I was asked prior to starting in the beginning of next week to - quoting - learn Classic ASP 1, I explicitly mentioned that I am a PHP developer (which I said beforehand, when explaining what my skill-set is) then the conversation went in to the direction that the software will be "converted" in to PHP.
Once started I realized that the software was written in Classic ASP, being operational since day 1, which was about 3 years ago and currently being offered as a service to others (kind of a SaaS). A lot of times I noticed that there are obvious major security flaws and I notified my team member to which he replied (emphasis mine):
Don't worry about security. At the moment we are building everything, once all is ready and it is working we will start adding layers of security where needed and it will be OK. I don't know why you are worried about security at this stage
Which raised a few red flags, however I considered that when we start rewriting it everything will be done properly. (I didn't knew that it was operating for so long nor that it was being resold)
It has been a few months now and the only tasks which I am required to carry out are to make security flaws in applications which work properly for the purpose to "integrate" them (resulting in automatic log-ins..)
Currently my opinion is discarded as soon as I start making an argument that he is wrong for something (strong-arming). There is no deployment strategy, everything is done writing directly to production files via FTP (although I am compensating on isolating the components I am developing and testing, maintaining tests and applying code practices and standards). No backups are in place, no encryption for anything and the "system" is built in a way that everyone working in here can view everyone's personal information including communication, and student works (assignments, exams, etc.).
I am suspecting that he is even leaking data (in form of student works) for personal profit, but I could not state that as all the people coming to speak with him, they speak in their own native language, which is totally different from mine native and English.
So after long description (for which I apologise and tried to keep as short as possible) my actual questions:
- How should I proceed to escalate my concerns, if they are closed friends with the CEOs?
- Should I blow the whistle to ICO ([Information Commission Officer] (http://ico.org.uk/)) that there are no policies in place for security and privacy and no maintenance being done? (which I noticed when a teacher was fired and deleted all presentations and stuff relating to the module we ware doing and my whole group was left empty handed on any materials)
- Should I notify higher levels (those running the programs and issuing the certifications) that I am suspecting that most of the student works are being purchased from members of staff and are not legitimate?
Again sorry for the long post and if anyone would like private discussion I am all for it :)
Discontinued by Microsoft in February 17, 2000; 15 years ago as per Wikipedia's ASP page on Active Server Pages