11–20 of 20 posts
It describes how much money they will personally owe and how much prison time each of them could do when there is a breach.
note: I have no financial interest in the company linked. It is simply the most comprehensive chart I have seen.
what bank do you work for, looney tunes acme bank ? Did your "senior programmer" dude never hear of salt and SHA1-Hash, fairly trivial to do ?
It is amazing that a "senior" guy would resist something as simple as hashing a password. That said, salting a simple hash is not nearly as effective as people think. Given the computing power of modern GPUs, you should use bcrypt: http://codahale.com/how-to-safely-store-a-password/
If i were customer of your bank i would withdraw all my money & ask to close my accounts.
discuss the problem with the higher management but never put yourself or bank's reputation at risk. Your customers will never trust you again.
I am sure every organization has loopholes. That doesn't mean they should shutdown their business.
Seriously though, I encountered a similar situation in a previous job. It was a media company instead of a bank, so the stakes were not as high. Still, they had user emails and plaintext passwords in the database. I warned the other developers and my manager about it, but they all dismissed the fix as a low priority task.
I spent some time digging through the web app's source code, and found an SQL injection bug. I then demonstrated the exploit to the whole team at a meeting. My next task was to implement the fix.
Your coworkers' attitude gives me the impression that finding an exploitable security hole isn't an enormous task. Sure, a live exploitation demo is a gimmicky internal marketing tactic, but it might work.
what bank do you work for, looney tunes acme bank ? Did your "senior programmer" dude never hear of salt and SHA1-Hash, fairly trivial to do ?
It's probably more common than we think.
While you're not the actual bank, your company is probably providing a piece of paper saying they're complying with the requirements the bank has provided (if they indeed have provided them).
So, assuming something evil does happen...
- Customer complains to state consumer agency
- State consumer agency refers to state banking agency
- State banking agency follows up with bank
- $bank says we have "a letter of compliance/best practices/whatever" from $company.
- State banking agency focuses on the information exchanged between $bank and $company, to determine which party was negligent, and maybe even refers case to state attorney general.
- The underwriter of your errors and omissions insurance is now royally pissed, and is also crawling through your e-mails and such to determine how much liability they have based on your policy.
I'm sure I've left out a few things, but basically, this is a st storm waiting to happen. If management doesn't care about losing the entire company, and possibly going to jail, I dunno.
And if you want, replace state consumer agency with FTC, and state banking agency with Federal Reserve.
Do nothing. This isn't your responsibility, and you're risking your job by going behind the back of the most senior programmer.
First of all nobody loves Cassandra, especially because it shows them they were wrong. Moreover, the moment something will happen you might be caught inbetween the shitstorm exactly because you mentioned the possibility and hence becoming suspicious yourself.
Do nothing. This isn't your responsibility, and you're risking your job by going behind the back of the most senior programmer.
First of all nobody loves Cassandra, especially because it shows them they were wrong. Moreover, the moment something will happen you might be caught inbetween the shitstorm exactly because you mentioned the possibility and hence becoming suspicious yourself.