help! my department is ignoring our own security policies

A reader writes:

My company has a written security policy requiring us to authenticate all requests we receive by phone or email before acting on the request or releasing any non-public information. This is a good policy, and necessary to protect both my company and our clients. All employees were required to sign an acknowledgement that we are aware of the policy.

Unfortunately, this policy is completely, totally, 100% ignored in my department. It’s not merely that we don’t follow it. It’s that absolutely no means exists by which we could follow it. There is no method whatsoever available to us to confirm that anyone who calls or writes really is who they claim to be — we take their word for it because we really have no alternative (unless doing absolutely no work could be considered an alternative).

Needless to say, this is a security vulnerability just waiting to blow up in our faces. I’ve mentioned it in email to both of my managers, and both of them failed to reply. Now, to my question (a 2-parter):

1. Is there some way I can approach this with management to get some action? I would like us to move toward a place where we can authenticate people and act in a way that protects both us and our clients. I see no progress (or even attempts at progress) on that front.

2. What steps do I need to take to protect myself? Sooner or later, an information leak is going to occur (assuming it has not happened already), and I don’t want to lose my job, or worse, be legally liable. With every call and email I respond to, I am in violation of a written company policy. Unfortunately, I have no alternative, as no authentication mechanism exists, and it’s impossible to perform any aspect of my job without responding to calls and emails.

You can read my answer to this question over at the Fast Track blog by Intuit Quickbase today.

{ 23 comments… read them below }

  1. anon-2

    Cover yourself. In writing. The worst thing that can happen is you’ll lose your job.

    Because, when it hits the fan, especially if you’re verbally told to do something

    1) “I was just following directions/orders” will not work as a defense. “You’re a smart guy/gal, you shoulda known.”

    2) I have been in situations like this where management gives a verbal order that has an aroma with it — and does not give the order in writing – to cover themselves.

    3) If / when things hit the fan – you’re going to learn two things —

    a) it’s every man for himself (or woman for herself)
    b) Don’t expect assistance from corporate counsel. They’re only interested in protecting the company – NOT YOU.

    Finally – you don’t want to be involved in a corporate scandal. That’s a skunk spray that follows you around. Potentially forever.

    Good luck.

    1. Jessa

      This totally. Cover yourself. Send an email confirming stuff. Keep a copy (if you have the authority to send email outside the building – some people don’t,) BLIND copy yourself outside the office. It’s very easy for the company to delete an email from their system if it hits the fan hard on them (if they’re crosswise some legal obligation or federal regulation.)

  2. Chinook

    I have to ask, are their state or federal laws around the privacy of information held by an organization? If so, there would be guidelines available that you could bring to your department head. I see this from a Canadian perspective where what you say is required by both Canadian (FOIP) and Alberta (PIPEDA) law.

    What this means is that the requestor must answer specific questions about their account before information is released.

  3. Jamie

    This situation horrifies me – but fwiw I think the OP is pretty great.

    I’d love to work with anyone who is aware of the policies that govern their work, knows why they matter, and is bothered when they are dismissed without explanation.

    I have nothing to add to Alison’s advice, which I would follow if I were the OP, but just wanted to let the OP know that while this situation may suck right now your instincts on this one say a lot about your character and will hold you in good stead elsewhere in your career.

    1. The Other Dawn

      I agree. This situation horrifies me also; I’m the information security officer at the bank I work for. Hopefully whoever wrote that policy is aware and has documentation as to why OP’s department can’t follow the policy. Auditors would have a field day if, in fact, no one has realized the policy isn’t being followed and why.

  4. Gemma

    Interesting – I’m a consultant and I do quite a bit with infosec (not a pitch: I’m not in the USA)

    OP is there a specific reason why the requests can’t be authenticated by the usual security questions process or is this data held to a standard (like a clearance level or interal check) in which case the clearance should be something you can check. Could you have authorised email addresses requests need to come from? Is the data you’re releasing even sensitive enough to need to be covered by this part of the security policy?

    While Alison has some great advice the problem solver in me desperately wants enough detail to tackle this.

    1. Jamie

      Hee. As a old hand at policy writing who makes damn sure my policies are able to be implemented and followed I also have the itch to solve this.

      I understand the need for lack of details – but this is a puzzle screaming for a solution and it’s making me twitchy. :)

      1. Jessa

        I had the exact same thought. If there are accounts attached to these requests is it not possible to ask for the same verification you do from a phone call? Does the OP not have access to the master data? I’m totally itching to find a solution for this.

  5. The IT Manager

    You say that you mentioned it in an email and got no response – but that’s not really the same as talking about it. Email is easy to inadvertently ignore or overlook, and it’s not well suited for important conversations.

    +1000

    Don’t assume the worst of bosses yet. It could be that your email is such a hard problem for them to solve that it has simply been back-burner-ed to get to as soon as there’s time. I’m projecting, but until recently I was overwhelmed with putting out fires and some harder issues that required thought (or simply longer email responses) lingered in my Inbox for an embaressingly long time because there was never time to get to deal with it.

    Specifially on topic: I agree with others that it’s great that you care enough to bring this issue up and not ignore it like everyone else around you is.

  6. ThatFormerHRGirl

    Ugh, this kind of stuff drives me insane!! One of the things that has kept me up all night in my current department at Company I’m About to Leave in 2.5 Days is that although we have a policy that states we can NOT transmit SSNs over email (fax or verbally by phone only), people do it ALL. THE. TIME. How is this so hard to follow, and how can people not understand the risk. I guarantee if it was their information potentially getting leaked/hacked they’d be PISSED.

    Ugh – thanks for the vent :)

  7. Michael

    I’ve found policies like this that aren’t widely followed, even by management, are interestingly ever-present should you fall out of favor with your boss and are quickly used to justify disciplinary actions. You’ve already raised the point with those you report to, though a face-to-face follow-up is in order. Personally, I would strongly consider looking elsewhere having been on the receiving end of the treatment I just mentioned. Oh, and should you point out that no one, including the guy handing down a reprimand, follows the policy that always-golden response of “that’s no excuse” stings particularly well.

    1. Lindsay

      Yes. My last job I got fired for doing things that others do every day.

      One of them was “voicing negativity about my job in front of subordinates”. I asked my boss how he could possibly cite me for that when he did the same thing constantly – made comments about people who frustrated him, complained about not being paid enough, went on the computer and searched job sites in front of me and talked about how he was looking for a new job where he didn’t have to devote his whole life to the job – to a much greater extent than I did (I made one ill-advised comment one time, I was asked by one manager to do something, and then by another manager to do the opposite and said “You know, I just can’t win with these guys”). He then proceeded to justify why it was okay for him to be frustrated and unhappy while I got the “that’s no excuse”. I called him a “f***ing hypocrite” in that conversation, probably not the best choice but I knew I wasn’t using him as a reference anyway and has just been termed with no rehire status.

      I was fired for political reasons (I was making more in my role than they wanted to pay others who they were about to promote into new roles above my own, the guy who fired me was out the door in a couple days as it was and firing me was his hail mary to try and make it look like he was doing something to fix his departments) but since they didn’t have anything justifiable to fire me on they went for mundane stuff that everyone does that is technically against the rules or technically poor form and he just threw a bunch of things on the DAR to make sure it stuck.

  8. Not usually anonymous

    I hope my story will give OP some ideas …

    I’ve gotten emails from students saying that teacher X (above me who makes the rules) has told them it is alright for them to be an exception and could I please tell them exactly how to break the rules in their case. Teacher X never responds when I ask for confirmation but the students also don’t take no for an answer and then try to get a yes from my teachers.

    First I asked teacher X to change the rules – unsuccessfully. Admittedly, it takes years to change the rules. Then I spoke to the department Y whose cooperation was needed to break the rules and they insisted that breaking the rules was okay …
    So, I cleared with my boss my announcement to my teachers that they should be careful with requests from students to break the rules, but direct (written) requests from teacher X and department Y should be honored. Then department Y started enforcing the rules. Did I have anything to do with their change of heart? I don’t really know.

  9. KayDay

    I think it’s really important to talk to management about this in person. However, one potential problem is that management might either tell the OP, “yeah, you need to follow the policies, *wink, wink*” and/or give only a vague response, such as “why don’t you ask [co-worker who isn’t following policy] how they manage?”. Since the OP doesn’t actually have the tools to follow the policy even if she tries, such an answer may make the OP look more at fault if the proverbial ordure hits the fan.

  10. Not So NewReader

    Can you find a news article that shows a company/organization that is doing a similar thing and is now in hot water?

    Conversely, can you research some common security measures that others are using successfully?

    It is amazing what you can find in an hour on the internet that makes managers pause and reconsider. Make sure you use reputable, well-known websites.

    I am a big fan of using the “we” word. “We need to figure this out…” or “We need to set something up here to protect all of us because we are all personally accountable…”

    If you address it as a team problem and the team can pull together and fix it- people might listen.

    I doubt they will fire you for speaking up. So the next major hurdle is being the lone voice in the wilderness. Just keep saying it over and over. Yeah, it is going to feel lonely, being the only person saying this- but you are right. So just hold your ground…

    I think we have people on this blog that can give you some great links to chose from. Print out the best of the best and give them to your boss.

    1. Anonymous

      Mat Honan. The story hit last year about hackers getting some info, not even a password OR a SSIN, and hacked his Amazon and Apple accounts, who then deleted everything on his Apple devices, including baby pictures of hid kid. He writes for Wired, I had to look up the story, but even without a name it was easy to find the story again.

      1. Anonymous

        Needed to add: While it wasn’t clear protocol wasn’t followed in his case, the fact they found you can still do it after he informed the companies involved of what had happened meant there was a failure somewhere.

  11. darsenfeld

    My honest view here is to find another job.

    It’s seems apparent to me that:

    – The culture in your department and even wider organisation is corrupted. It seems your managers, for whatever reason, don’t seem to give a damn.

    – I don’t think you’ll be criminally liable, and if anything if you get sent home then all of your department (including your managers too) should also be fired. If anything, you cannot be solely fired if all others are violating the policy.

    It is possible that your managers are receiving a directive from top management, and for whatever reason (most likely confidentiality) they cannot disclose it with other parties. However, it is possible that the issue is more sinister than one may perceive.

  12. GettinThrough

    Forget it. You should NEVER have brought the issue up to begin with. Not that it was wrong to do so, but because the upper culture of CIO’s, exec’s, etc’s… are too full of themselves to even tolerate a single critisizm about their network. They know their network is at risk, that’s why they didn’t answer you! All you have done is let them know is that you are aware of it. Guess what? You are the NEW liability. Time to polish your resume.

    1. Jamie

      There are as many kinds of people in upper level management as there are upper level managers. Some are excellent at what they do, some suck, and the vast majority occupy space somewhere in the middle of the extremes.

      Bitterness toward an entire level of colleague can really hurt a career.

Comments are closed.