Explain Security to Employer

Question

My employer wants/wanted to install a 3rd party app on my personal cell phone. One of the issues that we are still not seeing eye-to-eye with is regarding security.

Here are some issues that concern me:

1. The 3rd party sent everyone in our company the same password in a company-wide e-mail.
2. The app does not have a way to change the password.
3. All of our usernames are predetermined and easily guessable.
4. It's possible to login as anyone from any device into this app.

My boss has used a car analogy, suggesting that I'm requesting security similar to "full roll cage, 5 point safety harness, helmet, and HANS device, and a fire suppression system". I've pointed out that the security of the app is more like that of a Ford Pinto. I've compared his car safety analogy to "more like using 2-factor authentication with 32 character randomly generated password using a mix of lowercase, uppercase, numbers, and special characters stored via salted password (inefficient) hashing with each user having a different randomly generated salt".

I am no security expert. Perhaps I was incorrect with my response to him. Can someone point me to either a better response (e.g. an unbiased source)?

Update A few people have asked what type of app it is. The best way I can explain it is a social media app for just our company.

Answer 1

Let's address your points one by one.

1. The 3rd party sent everyone in our company the same password in a company-wide e-mail.

A password that everyone knows is not a password. It's like leaving the key under the mat, only without the mat to hide it.

2. The app does not have a way to change the password.

So if you ever lose your keys or think someone else might have them, you can't change the locks - and from point 1, we know that your keys are already in other people's hands.

3. All of our usernames are predetermined and easily guessable.

So, the people who have your keys also know where you live.

4. It's possible to login as anyone from any device into this app.

Put the first three together - other people have your keys, they know where you live, and you can't change the locks - and yeah, this is the result. Anyone can get into somewhere that should be yours alone. To recycle your employer's car analogy, he's asking all employees to lock their cars but leave the keys in the door, and then park in the company car park underneath a sign with their name on.

And on top of all this, he's asking you to do this on your personal phone. Your employer has no right to be touching that device. Depending on what this app does, this could be exposing your personal data to risk because of a third-party security flaw that you have no control over.

Even if the third-party app isn't malicious and doesn't do anything that causes a risk, there's no guarantee that it's 100% free of accidental flaws or bugs that might cause a security weakness or present an opportunity for some other malicious party to exploit. Given this third-party company's atrocious handling of basic security practices like "don't email passwords", "don't re-use passwords", and "always allow users to change their passwords", the chances of their app being completely safe, secure and free of vulnerabilities is looking pretty slim.

Answer 2

My advice is to try to explain the security implications from a risk based approach. What could happen if you installed an app with such poor security? You don't have to explain how to take advantage of the poor security in the app, but just expose the risk. Impersonation alone is a very significant turn off for many managers, someone could do something bad and blame another person, even as a prank it could lead to serious repercussions.

In my experience, managers need to balance risk with benefit, and once they see what may go wrong they start to wonder if its really worth it.

Answer 3

While analogies are useful when explaining basic concepts to someone completely unfamiliar with the field, they actively harm professional discussions. Understand that every analogy is subjective, and non-representative of any field-specific details. Actually, the car analogy is especially bad because it confuses safety and security. Bottom line, use analogies with care, and stop using them the moment you feel carried away.

Instead, I would ask your employer how to deal with specific threats you can identify. For one, this app seems to be vulnerable to impersonation. Tell your boss how you can use this app to pretend to be someone else, and ask him what counter-measures will be implemented to prevent this.

Answer 4

Without knowing more about what type of data this program has access to, I can't really advise you, but it does sound like terrible security practices. Your boss's analogy against security is also a very bad one: this is one of the many ways breaches start.

If, during an audit after being breached, your company is revealed to have subpar and extremely incompetent security standards (such as what he's suggesting now), he could be held liable for any damages to customer data.

• The 3rd party sent everyone in our company the same password in a company-wide e-mail. Shockingly common, but it depends on what this is used for.

• The app does not have a way to change the password. Now this is terrible. What happens if one of them gets hacked, or an employee is disgruntled and leaves?

• All of our usernames are predetermined and easily guessable. I've actually come across several of these implementations in both usernames and passwords in the past. With usernames, such things are to be expected. For example, many companies set your email address to lastfirst, first.last and other variations. I'd be more worried about passwords in this case.

• It's possible to login as anyone from any device into this app. So what does this app do? Knowing more about the app would allow us to offer better advice.

Concerns about the "program"

Here are some things that concern me: I've seen this before. It may be completely different, or it may be the same. Take this with a grain of salt.

This sounds like your employer is trying to ask everyone to install something on their personal cell phones so they can monitor your phone usage like a trojan horse. Tell your employer that you'll be more than happy to allow this if provided a company phone.

Keep in mind, you should not have anything personal on your company phone. Your employer can and will snoop around. In fact, even using the company exchange email on your personal phone can allow your employer full control over it. It's right there in the requested permissions when you try to set up your company email, even if it's on your personal phone. Don't do it.

I'm of the opinion that BYOD shouldn't be allowed, and that all devices connecting to a machine should belong to the employer. Personally, I would not use my personal phone or devices on my employer's network. I wouldn't want to accidentally introduce a vulnerable device to the network, and I wouldn't want them to introduce a vulnerable application to my device.

Answer 5

Your cell phone, your security

It is your cell phone and you have the right to secure it as you see fit. However, you may consider taking the opposite approach - saying it will not be secured at all (see below).

Their cell phone, their security

If your company demands that you use a mobile device to access company data, which is well within their right, then the company should provide that device, secured to their specifications. That way they take responsibility for securing the platform on which their application resides.

Corporate data security policy

Look at your corporate security policy and look at this from a corporate security officer point-of-view:

By using your device, they cannot possibly ensure the security of the data the application is providing, nor the security of the app itself, as your device is not a secured platform.

What is the policy of your company regarding laptops? Do the laptops have to have encrypted hard drives? And, be secured? If so, then so should the phones, which points back to them providing their own devices for this purpose.

Flip the Argument - be concerned about their data

(Note: This may not work if your company is fast and loose with data security.)

Instead of saying you keep your device super secured, you instead say that you cannot ensure it will be secured, that other people will have access to it, and you cannot take responsibility for any data breaches or accidental data loss.

For example, if this application deals in any way with PII data, or could be a vector to obtaining PII data if hacked, your corporate data security officer simply cannot allow it, unless your device is under their control - making it their device.

What if your phone is lost? They don't mind that their data is accessible? What if you let your little cousin Willy play with your phone, forgetting the app is still open and available, and little Willy deletes data? Is that OK?

By taking on the role of protecting their data, you are making a business case that using personal cell phones to house corporate data is bad business decision.

Answer 6

One thing that a lot of people lose track of (on both sides of the fence), when talking about security, is:

What are you protecting?

I have several accounts "protected" by one, easy to guess password. This is because, if it gets hacked, I don't care.

Is the password protecting your phone, or is it protecting the company's data? If you have to know the password, then I'm guessing the later. If so, the fact that it's on your phone is somewhat of a red herring - your phone is not at risk. In fact, your use of the app does not increase anyone's risk - if you never use it, the risk remains.

What is the value of the data, if it is stolen or modified, to the company? What damage can be done?

If there is little or no consequences to this data getting out, swallow your pride and move on.

In cases like these, unless security is your job, you may have little influence regarding this software. Put in writing your concerns - that an unauthorized person could relatively easily copy/modify whatever data (as appropriate, depending on what the app does), point out the potential embarrassment/losses to the company/lost customers (if appropriate). . Be prepared to be ignored, and if you do, accept it. Keep a copy of the letter/email, just in case.

I hope this goes without saying:

DO NOT! UNDER ANY CIRCUMSTANCES! HACK THE SYSTEM TO SHOW IT CAN BE DONE! EVEN JUST A LITTLE BIT! (unless you are explicitly authorized by the company to do this!)

It is tempting for many people to "show" the risks. Embarrassing security admins (or anyone!) who are bad at their jobs is a terrible way to make people grateful to you - even if they probably should be.

Answer 7

Assuming that the app provides access to some private information, you should just provide a Proof of Concept to your employer. Ask him for an official permission beforehand to do so(doing any such thing without permission might land you into trouble, depending on your company's policies). After you've secured the permission, show him/her how easily can you login using his/her credentials and gain access to private information.

Also, without every employee's explicit consent, the company shouldn't have any right to install any kind of data on employees' personal cell phones.

Answer 8

The problem - which might not be a problem at all, depending on what the app actually does - is that you can log in as someone else, and someone else can log in as you. The password never changes, so pretty soon people who no longer work at the company can still log in as someone who does still work there.

The scary thing is that the 3rd party company does use passwords despite passwords being pointless in this case. If everyone has the same password, there shouldn't be a password at all. This is scary because it shows the company does not understand security and should not be trusted with confidential data.

Simply put, if the app is only there to figure out who brings cake to celebrate something, who likes what kind of cake, and to prevent too many cakes from being brought in at the same day, you're good. However, if the app is used for confidential data such as performance tracking and reviews, your company might soon be in legal trouble. Despite what the 3rd party does, it must be obvious to your company that the data is not secure, therefore part of the responsibility rests with them.

If you need an analogy, these files are either stored in a locker, inside the company office, and only select people have a key, or the files are stored in a cardboard box in the cafeteria - and the cafeteria is open to the general public.

Answer 9

for starters, you should tell him that it's your personal cell phone and he has no right to mess with your phone.

using your car analogy, the app looks like that the car uses a warded lock (I hope wrote that correctly) and the fact that everyone has the same password that cannot be changed gives them a skeleton key, so all that's left is guess where you left your car (a.k.a. what your username is), which isnt that hard for people inside the company and then steal your car.

well storing passwords with a salted hash is the minimum standard these days, so that wouldnt count that much ino your security, but as a description for your mega-safe car I would describe a 3-factor (password+key+biometrc) lock.

Answer 10

IMHO first of all when talking to high bosses - start with losses. They do NOT like them, but to make a desirable effect, you must make a really GOOD evaluation of every loss, in $. The most effective vectors - according to my practice - are :

1. Law enforcement costs. What penalties by which law are appliable to your company if things go wrong. Make a full list, law+"penalty amount"

2. PR losses. To calculate that just take a company profit data and cut it a half, for a scenario of competitor(s) take the company's current place at market due to reputation loss/damage.

3. Recovery costs for pt.1 and 2 Yes, every damage needs a repair! And it costs some money, usually

But do not stop here! You also MUST provide a very detailed plan with a Gantt diagramm attached about how to make things right : time and costs, step by step

And just make a numbers in your final slide, let them compare. It worked many times for me, but you need to invest a good part of your time and patience making all theese tiny nuts-and-bolts working together as a swiss clock.

Answer 11

I recently retired from ten years health care I.T. preceded by sixteen in defense. In health care, an annual audit finding that app would have serious unpleasant consequences with government-mandated public quality ratings. In defense, a random audit finding that could send someone to prison.

If my employer asked me to put that on my phone, besides pointing out the above, I'd suggest to the manager that someone pissed at him will log in with the manager's name, post pornography, and get the manager fired.

Answer 12

This is all about risk assessment. That's should be a key concept for a manager. He needs to understand the risks -- not the technicalities, but the actual risk. So explain it like this:

Fact: Everyone has the same password and username format, and can't change it.

Risks:

• Disgruntled former employees could log in as anyone and read anyone's messages, or send messages under anyone's name.

• Current employees would be able to misuse the system by logging in as other users to 'prank' each other, eg by sending messages "from the boss".

If your boss doesn't want either of these things happening, then he needs to sort out the password problem immediately.

The disgruntled former employee risk is probably the most significant: if you fire someone it should be easy to revoke all their access rights, but if they know how to log in as anyone else in the company, then revoking their rights won't do anything to stop them leaking all your company secrets to your competitor that just hired them.

You haven't revealed what the app will be used for, other than a vague 'internal social media' comment. The severity of the risk to the company will depend on (a) how many people are using it, (b) the level of seniority of people using it, and (c) what kinds of information is sent through it.

For example, if the app is intended for the staff simply to have somewhere to chat among themselves then the risk is lower than if management intend to use it to send confidential information to staff.

There is still a risk though regardless, because even in the most benign case it would still make for a wide open opportunity for social engineering.