Implementing something your boss has asked for, even if it's potentially a bad idea

Question

For my company we are creating a private portal so the company can log in and get the information about their product from our website. My boss wants it to be that only people logging in from that specific area can access the files. I.E. not going home and logging in and showing their wife of friends, or them getting fired and showing off the documents to our competitors.

For that reason, my line manager told me the over all boss wants me to lock IP addresses to accounts so that you cannot access it unless you are in that particular location. I think that this is not a good idea for several technical reasons.

The major question is, the boss is a bit of wildcard. He is not the most tech savvy and does what he wishes, I can tell my line manager but he will tell me just to do it because the boss has said so. Which I can respect, just a bit of a catch 22, Should I be doing something I know is potentially a bad idea?

Answer 1

Your boss is paid to make decisions and to take the blame when his decisions turn out wrong. It is your duty as a responsible employee to make your boss aware of problems you see in their decisions. But when they decide to take the risk, you are paid to do what they say.

But you should make sure that you wrote him an email explaining your concerns. Should things go wrong and people start looking for scapegoats, you can pull out that email and say "It's not my fault, I told you so".

Answer 2

Let me separate this into two questions:

1 - Should you do what your boss tells you?

Yes.

In the end, they are paying you to do work. Take the money and do the work, or don't take the money and don't do the work. What he's asking for is not unethical or immoral, it's just unwise.

Most folks won't quit over one stupid order, but if you really have no faith in the command structure and it's ability to do smart things, then figure out how much that matters to you in terms of general job satisfaction and also whether or not you can take steps to change it.

2 - In a knowledge working position is it acceptable to question the management?

Yes - absolutely.

Different jobs work differently here - for example, if you were in an industry that centered around rapid response (say, the military, or in an ER), then questioning the boss under time-critical conditions may be an absolute no-go.

But in knowledge working, it's generally assumed that individual contributors have advanced skills and training and will be making independent choices. When a directive from management goes against the good sense of your more detailed knowledge, it's fair to question the directive and raise counter points.

The key here is usually that you won't get far with flat out negation, instead, look into alternate strategies and suggest a path that gets the objective done, but in a better way. And put together ammunition that is worded in business-related concepts, not technical ones. In this example, in particular, I happen to agree with you - I've seen IP locking implemented and it's induced a lot of pain and suffering. But the point that the boss has of no-remote-access is a fair one from a security/business risk perspective.

So, I'd start with this process:

Get Details

Does your boss or the big boss understand that you may accomplish very little with IP locking? For example:

• do people take their laptops home? Can the files be uploaded at work to the laptop and then brought home?
• does the portal itself have limitations so that data viewed on the portal can't be copied to a laptop/desktop?

Rather than the technical angle, phrase your concerns in a person-centric way - for example, if I was the user and I wanted to work on a report late at night, I'd copy the data from the portal to my laptop and then work from home on my laptop after the kids go to bed... is that feasible here?

Is this covered in other parts of the business? To what lengths does the big boss want to take these security measures? Chances are really controlling this will be more expensive than he really wants...

Clarify the ramifications in terms non-tech folks can understand

I suspect that the reason you dislike this solution is:

• hard to administrate -> means that users will have more trouble logging in the first time, and any changes in the at-work system could cause outage when users suddenly can't connect - in terms of the business, this could mean big delays in satisfying customer needs.

• expensive (sometimes) - is there a cost in terms of equipment licensing or other features? Money is something business users understand. Also factor in time to administrate - paying for your time while you do maintenance instead of other things.

Offer something better

Come up with a better option that gives the boss what he really needs at a lower price than this option. It's hard to argue when you are getting what you want. Don't deny that there is a business concern or risk - this is where the boss probably does know best. But find a better strategy and then find a way to explain in non-tech why it is better.

Answer 3

Points to be taken into consideration:

• You are the one implementing the stuff. You should be able to tell your boss what will work and what wont.
• Your boss is the one who is responsible for the decisions taken based on your input. Your job is to make sure that your boss is kept up-to-date with the concerns/limitations.
• It doesn't matter if your boss is not tech savvy. It might not be his responsibility. It is completely your responsibility to provide the technical view of the solution. Your manager's job is to provide the business angle to the solution. In turn, your manager might get these scenarios from your end user.
• List down all the solutions and the loopholes due to these solutions. If your manager wants to go ahead with the loopholes, you need not worry. The onus lies on the manager.
• Capture every concern/limitation in a mail. If you feel that something that the customer is expecting might not be the right thing to do, do let your manager know. He can get back to the customer and let them know about the same (not always are the customers right).
• Finally, if your manager is sure about the approach to be taken (either due to business requirements or due to customer requirements), you should go ahead and implement it. Sometimes what sounds technologically perfect might not serve any purpose to the end user.

Answer 4

As a professional working in the InfoSec profession, I agree fully the spirit of your boss's request, but not necessarily with the recommended approach.

Your boss is trying to limit the amount of people who can access the product data of your company, by restricting access to only the company premises. This is a good security practice, in line with Principle of Least Privilege. Allowing public access over the Internet unnecessarily increases the company's exposure to the risk of unauthorized data disclosure.

In addition to potentially unauthorized disclosure of data, there are other risks that are increased by allowing public Internet access such as risk of internal network compromise from threats such as malware on the end user's computing device. You did not explicitly state the security classification of the data, but if the data is sensitive, then the boss has a very valid point in wanting to protect the data to the greatest extent feasible. However, you questioning whether the proposed method is the most effective is entirely appropriate and **something you should be doing.

A client connection over the public Internet is by default untrusted and could contains all sorts of nasties that the company may not be able to afford to be attacked by. Unless the connection that you use is properly encrypted, such as through a properly configured VPN tunnel using an industry accepted encryption protocol (ex: SSH, IpSec etc.), then any traffic flowing over the link can be easily sniffed on the wire through man in the middle attack. Also, unless you have a client certificate , the company cannot be certain that your machine is what it claims to be.

To summarize, you should absolutely follow the spirit of what your manager wants, but not necessarily the way he is proposing on doing it.

Answer 5

It seems like the real goal is to secure this site by limiting where it can be accessed. It's the company's information, so they can do with it what they want.

Your boss isn't technically savvy, so why don't you make sure you understand what he wants to accomplish and ask if you can try another solution? If not, I don't see what the problem is if you implement the poor technical solution and then show it doesn't work. If you foresee a lot of problems undoing this solution and implementing something else, you need to make sure the boss understands that up front.

Like most people have indicated: you make suggestions, the boss makes decisions and no one is perfect.

Answer 6

I would suggest to view the requested access restriction and the tech details of how to implement it as two separate things. Managers are requesting that access to the material only be possible from a certain physical IP address. That often means "from a specific physical location". I do not find that offensive at all. If that is what management want then I suggest that is something to take as a concrete requirement. The next step is to assess if their technical suggestion to lock to IP address is the best one. If you think not, then provide some arguments for why not, AND most important; suggest a solution that both fulfills the requirement and is a feasible thing to accomplish.

I suggest if you can´t imagine some alternative solution, then go ahead with the IP address way. If so then make sure to inform the manager(s) up front of any security concerns you may have, and have them confirm this is what they want.

Answer 7

It's a pain, but sometimes you have to implement your solution to account for your bosses' shortcomings. You can see things that he cannot. That's okay. Rather than doing the work twice, put in a solution where it's configurable. In configuration "a", it works the way your boss asks. In configuration "b", it works the way they're gonna need it to work when they figure out they've hung themselves. Switch between them using a configuration file somewhere. Voila.

You're the hero in both cases -- as long as you are humble at it.