September 2008 - Issue 3

View Online

Tell a Friend

Top Banner

Complimentary On-Demand Webinar

A CISO's Guide to Securing Open Source Software

Attend Now

Fortify Software Offers Universities Free Security Software for Teaching and Research

Read More ...

Reader Survey

Complete our one-minute reader survey, and you could win the book, Secure Programming with Static Analysis.

Passing PCI Compliance Section 6.6 White Paper

Organizations that store or process credit card information must secure all Web applications.

Learn pros and cons using two different approaches.

Download Whitepaper

Outsmart a Hacker

Dig Your Own Hole

Subscribe here or manage your subscription.

 

ISE Northeast Executive Forum and Awards Gala

October 16, 2008

Marriott Marquis Times Square

New York City, NY

OWASP

CERT

More ...

Security & Privacy

darkREADING

More ...

Issue 2
[More...]

What's Your Best Advice?

Back to newsletter

Previous Issue's Dilemma:

Real politics in the office

I liked one candidate; my boss preferred another. That should be fine, but it's not. My boss continually chided and ridiculed me in front of others for my preference.

Finally, I got tired of it and used an XSS vulnerability on Obama's site to redirect people to Clinton's site. See for yourself.

 Now, the Secret Service is interviewing all the people in my office. I think this will affect my future at the company. Should I tell my boss to keep his opinion to himself, or should I wait and make a statement to the press after I'm arrested? What do your readers suggest I do? 

-- Paul (company withheld)


You were wrong!

Paul, our readers were unanimous in their opinion and a little angry with you. When you hacked in, you became one of the enemies that software security professionals try to thwart. Shame on you.

Fortify

Complimentary White Paper

The Case for Business Software Assurance

Hackers now concentrate more on the application layer. This helpful white paper provides an overview of the current hacking landscape and the people, processes and technology to develop Business Software Assurance in your organization.

Learn about the 12 "Maturity Areas" and much more.

Download this complimentary white paper.

Typical reader comments:

  • Own up to it and bite the bullet.

  • Get a good lawyer.

  • You should be ashamed.

Own up to it and bite the bullet

R.B. says to confess: 

"This is less a technical than a moral question. What you did was wrong and could likely cost your job, but it's done, and there's no way to undo it. So how to limit the damages?

"In my opinion, it is best to confess as early as possible. Waiting usually will make everything worse. Maybe you should talk to the Secret Service people first. This will stop further investigation. Confessing to your boss will help to explain everything to him. Maybe that will make him merciful. Maybe you'll lose your job."

R.B. adds, "If you don't confess and the truth is discovered, you'll be fired AND get a bad reputation. God forgives, but we'll still have to bear the consequences. Good luck!" 

Get a good lawyer 

"Stupid, stupid," comments H.S. from Michigan. "What you did was very stupid. You are a disgrace to our profession. Get a good lawyer, because you'll need one. Forget about keeping your job; you won't have it much longer." 

Another reader, J.S. from California, agrees: 

"Chiding and ridiculing you is lame but not illegal. Exploiting a weakness in a Web site is illegal. Get ready for fines and maybe jail time. Who knows, you may meet up with O.J." 

You should be ashamed 

Rob from Illinois echoes what J.S. said: 

"Your boss is a jerk, but you are worse. How could you hack a Web site for real? That's against everything we try to prevent. You should be ashamed." 

Our readers have spoken

Your boss is insensitive, but you were wrong, wrong, wrong and should pay for what you did. If our readers had a vote, you would be voted out of a job and out of our profession. 

fortifylogo.gif
productsandservices.gif solutions.gif resourcecenter.gif customers.gif partners.gif newsandevents.gif aboutfortify.gif

"ConnectedIn Media consulted in the development of our e-newsletter and
made the process easier than we ever expected."

-- Sherry Ramm, Director of Global Marketing

Fortify is concerned about your privacy. We do not rent, sell or exchange email addresses. Copyright 2008, InternetVIZ. All rights reserved. You can write to us at 2215 Bridgepointe Pkwy, Suite 400, San Mateo, CA 94404.

You are subscribed using the following email address: . If you wish to change your selections or unsubscribe altogether, click below.

:: Subscribe to this newsletter ...
:: Unsubscribe
:: Forward
:: Manage

Powered by TailoredMail