How can I explain technical concepts related to business management who lack background to understand?

Question

I am an IT auditor. I am writing a report for a security review / audit that I completed of a business application used by my company. I have found weaknesses related to MITM (Man in the middle) and insecure hashing of passwords.

This application stores and processes rather sensitive information which includes Personally Identifiable Information, including but not limited to social security numbers. Obviously, given the nature of this data, security and confidentiality are crucial. Without strong encryption through TLS version 1.3, information could be disclosed and or modified in transit.

My question is, how can I explain to management this risk to business without explaining the technical details? My goal is to have management understand the risk to come to a educated decision regarding taking action on this point.

Answer 1

As this answer says, you first explain the consequences in ways relevant to the manager -- compliance, sales impact, bad publicity, ethics, or whatever applies in your case. In addition, though, you should be able to explain the technical aspects, at least at a high level, to anybody from your peer to your manager to your Uncle Ted who still uses a VCR to watch TV shows.

For example, here's how Wikipedia's page on MitM attacks begins:

In cryptography and computer security, a man-in-the-middle attack (often abbreviated MitM, MiM attack, MitMA or the same using all capital letters) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

(Wikipedia is a good place to look for accessible explanations of specialist topics.)

Understanding that doesn't require any technical knowledge; you're explaining that there is, as the name implies, a "man" (agent) in between the user and the server he thinks he's communicating with. You can then go on to use an example to explain what happens and how the attacker gains access (as that Wikipedia page does). Start high-level and let the manager's questions guide what else you say; he probably doesn't care about the details of encryption algorithms or DNSSEC or certificate pinning, so don't lead with the technical details. (If he does care, he'll let you know.)

The reason you are having this conversation at all is probably that you need him to make a decision. Give him the tools to make that decision, be ready to provide additional information if he asks (or clearly needs it, e.g. because he's misunderstood something), but help him focus on his problem, not yours.

Answer 2

You've pretty much answered your own question here:

How can I explain to management this risk to the business

You need to phrase your report in these terms: what would happen if a third party got its hands on those SSNs? I don't know the precise answer to that, but it's a combination of "our customers lose all faith in our business" and "the regulators drop a ton of bricks on us from a great height". Both of those are clearly bad outcomes, even to a manager without any technical background.

Answer 3

I've had the pleasure of talking to people of all levels of technical competency, from high-powered techies all the way down to people who literally did not know how to turn the things on.

The best way to talk tech to a non-techie is: Don't.

Analogies are the only way to get your point across translate the effects into terms they can understand.

For example, I once was asked what the difference between PC memory and HDD memory was, and what each did. I used the analogy of a desk and a file cabinet. I told the person that if you have a big desk, you can have plenty of things on it before you need to go to the file cabinet, but when you do, you need to stop what you're working on to do it. The desk is your memory, the file cabinet is your hard drive. The more memory you have, the less often your computer has to go to the HDD, and the faster it works. It's the same as if you had to stop working and go to your file cabinet constantly.

Take a similar approach with the management. Explain that Encryption is a lock and that the data is like the contents of their house (use a family member's house for a higher impact). And just like you wouldn't want to put a cheap lock on the front door so that even an amateur could break in and steal or hurt a family member, you don't want cheap encryption (lock) that even a script kiddie could break through and hurt the company or it's customers.

Answer 4

First of all .. if you are such storing sensitive information, it is most likely that you must conform to some sort of external regulation regarding how to store that information. In such a case you can simply say to management that you don't conform, and point out the penalties for non-compliance. You shouldn't have to explain the nitty gritty to them as they are paying you to understand that part for them.

Secondly, if you aren't in a regulated industry (but it sounds like you should be) then you can't teach management technical details as after all, if they found technical details all that interesting then they wouldn't have pursued management. You only recourse then is analogy, the simpler then better.

After steps 1 and 2, if management still doesn't want to listen then you have to make a judgement call as to how you feel about working there.