I am in an "argument" with my company about them showing each and every employees social security and full banking routing / account number in plain text on a leading hosted HR Management software application. They have the ability to hide it, like every other application I have ever seen, but they refuse to for their convenience. They cite things like it is hosted in the same server farm as the CIA.

I am not too concerned with security in the backend systems, just the fact that they present the data to a user logging into the system in the front end of the application in plain text (though encrypted). I know it is bad practice to do this, but I can't get them to budge.

I believe that the application has 2 factor authentication set up for reports and more data vulnerable functions. The application does use RSA 2048 / sha256RSA.

I have brought up the Sony, White House, Anthem, and OPM hacks, but they still shrugged it off.

Does anyone have any suggestions on how to convince them to turn on masking of these fields (XXX-XX-1234)?

Are there any laws, lawsuits or other kinds of guidance that I could cite to help push the securing of this information (like PCI DSS compliance)?

I guess the real question should be: How do I elegantly explain this to "people who do not understand the actual risk"? (this was run by the "risk manager" as well)

Previously asked here, but am looking for a legal aspect to the question.

  • 2
    "plain text, though encrypted": huh? Plain text specifically means unencrypted. Also, if they are displaying the number to the user, it's clearly not encrypted at that point. Where does encryption actually enter the picture, and, more importantly, is encryption at all relevant to your question? – phoog Oct 31 '16 at 19:26
  • The encryption happens between the web server and your computer via HTTPS:\\. The problem with this is that someone can perform a man in the middle attack, in which they can then read all of your information, including your SSN and ABA numbers, which is why you would mask these numbers in the communications. – Lucky Lindy Nov 1 '16 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.