I am in an "argument" with my company about them showing each and every employees social security and full banking routing / account number in plain text on a leading hosted HR Management software application. They have the ability to hide it, like every other application I have ever seen, but they refuse to for their convenience. They cite things like it is hosted in the same server farm as the CIA.
I am not too concerned with security in the backend systems, just the fact that they present the data to a user logging into the system in the front end of the application in plain text (though encrypted). I know it is bad practice to do this, but I can't get them to budge.
I believe that the application has 2 factor authentication set up for reports and more data vulnerable functions. The application does use RSA 2048 / sha256RSA.
I have brought up the Sony, White House, Anthem, and OPM hacks, but they still shrugged it off.
Does anyone have any suggestions on how to convince them to turn on masking of these fields (XXX-XX-1234)?
Are there any laws, lawsuits or other kinds of guidance that I could cite to help push the securing of this information (like PCI DSS compliance)?
I guess the real question should be: How do I elegantly explain this to "people who do not understand the actual risk"? (this was run by the "risk manager" as well)
Previously asked here, but am looking for a legal aspect to the question.