VW fired senior employee after they raised cyber security concerns
ft.com
ft.com
>VW said the information provided proved to be “irrelevant” and that “the employee was terminated due to fundamental differences in the way we work together”.
Better PR would be something like "While the reported issue turned out to be a misunderstanding, we appreciate and encourage all employees to speak up if they have similar concerns. Our separation from the employee was in no way related to their reporting of that incident - if anything, it was a mitigating consideration."
At a minimum, you are starting with a bunch of people who default to cheating and lying as a solution to problems. You can put in new barriers to it, but these people are skilled at beating barriers.
I say this as a cheater and a liar.
It also doesn't help that careers with companies are so short. I have no stake whatsoever in whether a company I work for succeeds long term or not. Just want a nice resume line really.
I really appreciate the honesty that can be obtained via anonymity. It might be interesting to have honest discussions with "bad" people, but most of them appear either not self-aware, or refuse to be honest about things.
I have worked for a company that had a data breach.
- If I said in the post mortem that I didn't report the issue as it was more work and I could not be bothered, people would be enraged, but beyond the yelling, I would probably survive in that role.
- If I said that I didn't report the issue as I wanted to seem like a hero when I fixed it (real thing my boss did from my days at another company), I would be fired.
- If I didn't report the issue due to not knowing the right channel, they criticize my lack of initiative, but it is understandable.
- If I did not report the issue due to not knowing about it, I am blameless.
You cannot admit to being a bad person without taking a lot of flack.
Ofttimes, I think the people most willing to self-label this way are those most aware and conflicted by their behavior.
In my experience the people I've seen self-label this way (in a non-anonymous way) do so because they think it reflects well upon them (it's 'cool', demonstrates intelligence or superiority, etc.). It is usually the limit of their self awareness and they are never outwardly conflicted. My inner arm-chair psychologist thinks it stems from varying combinations of insecurity and lack of empathy.
Seems like more of a British thing. They're also IMHO more willing to take an honest ribbing over screw-ups without getting all pissy. They take it and dish it out.
(In seriousness, that hypothetical PR statement is one of those sentences that makes you reflect on the power that messaging has. It also means that you can't trust a PR-driven image on the culture of a company!)
IE, it's hard to have a professional relationship with an experienced engineer when I need to explain things like "never trust the client because a hacker will 0wn you with Curl."
I suspect that VW has someone who's been there a long time, who is a "lead," and just doesn't understand basic security concepts. Some newcomer challenged them, and it probably grew unprofessional. It speaks poorly of their management if they need to terminate someone in a situation like this.
We just don't know. (Can't read the article because of paywall.)
It's like divorce. I know many, many people who've been divorced. The story from one party is usually very, very different from the story from the other party. Who knows what the actual truth is.
A bit different from two ordinary individuals.
I think there is a bias a lot of people have towards believing the organization, because the idea that bad things happen to decent people is discomfiting.
I hate the phrase "just world fallacy", it's not a fallacy, but it's certainly unpleasant to contemplate misfortunes that could happen to you, or me.
Experience with corporate litigation will change your opinions on whether individuals or organizations are more to be trusted.
But your first sentence sounds to me like "I've been walked on by mosquitos far more than by elephants".
On average, the elephants you meet probably won't be in the mood to bite or step on you. On average.
Then leave. That's your only recourse.
Even if you think all the people around you are fuddy-duddies and "should know better" - that's no need to resort to tones of exasperation and condescension. You probably figured out pretty early on what the environment was like -- and for whatever reason, you made an adult decision to stay in that environment. When someone around you doesn't understand something -- just explain it to them with respect. And yes, patience. You're there to help, after all.
Or maybe you're not. In which case you should just leave.
Only if the culture over values conflict avoidance. By other management philosophies, it is preferable to encourage (healthy) conflict, which can include waves of emotionality which can be uncomfortable for many people. It's a business, not a therapy zone, so that seems like an occasionally appropriate tradeoff.
Yes, it can seem to sort of work for a while. But over time, not so well. Resulting in burnout, and the desire to seek greener pastures.
Many people for whom factual truth is anathema to their self-esteem.
I worked in Automotive for quite a while, and this wouldn’t surprise me. A lot of the roots of my company was mechanical engineering, and software at the time was very secondary. It was changing rapidly (and positively) over my last few years.
I was responsible for system security for one of our internal systems. I found a major vulnerability - SQL injection with full schema owner privileges on all our pages. So I went to the principle/dept head to see how they wanted to staff the remediation and which of the two proposals they wanted to go with.
I was told they have a near real-time backup system and it's only and internal system (that handles obscene amounts of money), so they didn't want to address this. I asked if we have any documentation about the restore process or how long it would take. Nope. Have they ever tested this restore process. Nope.
Goodbye! Posted to a different team very quickly.
Nobody can prove anything to their employer. And, you don't owe them anything. So, sometimes the best that can be done is to leave them to fail without you.
It sucks, though, when it is a bridge you know will collapse.
The firm hired some crack cybersecurity consultant - who was probably in on the joke. The guy mulled over the software, and found some Rube-Goldbergesque CVE-worthy exploit involving timing attacks, privilege escalation and what not. It was an impressive find, and they probably tried to insinuate, that the software was this hard to exploit.
A week later, I was debugging some memory leak - it turned out the app was hanging on to some authentication state objects, which among other things contained the username and plain-text password of every login attempt. Now, the software also had a feature of writing memory dumps when it crashed - another thing that was not terribly difficult to achieve. So the attacker could just walk up to the public computer, click around a bit, make it crash, then copy off the resultant dump file, and see everyones credentials who ever tried to log in.
I was a junior guy back then. When I told my boss, he realised that this was so embarassing, that we just fixed it - no bug ticket, no formal announcement, no nothing. This software handled very sensitive data.
Yet another way companies encourage me to do the bare minimum.
You could improve the air quality to be better than if your car existed, if you weren't generating carbon pollution and were say removing pollutants from the air as you drive. In reality this would be really hard, but if you had solar powered car and removed nox or something. But then you get into the infinite tail of the energy and pollution used to make your car.
This way you have hordes of "software engineers" who don't raise such matters. Maybe that's the reason why those German companies find it so difficult to hore external experienced consultants?
Two more words: "run away!"
As if this segmentation would improve cooperation between departments if every department is their own little mini company.
So now companies that do other things are calling themselves software companies so that their software development will not have to be a cost center. Or "technology companies", as Bloomberg, e.g., which delivers financial news, calls itself now.
It is deeply stupid, but entrenched. I don't know how software stands at SpaceX, which is a "technology company" that, nominally, makes rockets. Is the software that runs in processors physically on board a rocket production, thus a profit center, while the stuff that runs on the ground is facilities, thus a cost center?
archive.is uses security technology that is outdated and vulnerable to attack. An attacker could easily reveal information which you thought to be safe. The website administrator will need to fix the server first before you can visit the site."
I'd argue that if your boss is refusing to act on a serious security concern you have a moral duty to take it further up the hierarchy yourself, and to (responsibly) disclose to the government/public if the company won't listen. Shrugging and saying "Well, I tried!" isn't good enough.
There are more things and nuances specified, but the idea of "this is critical, but oh well my manager ignored me... nothing more I can do." doesn't seem to breed organizational success. (By no means I am advocating for insubordination per se.)
I would never go public without going to a lawyer first, and getting enough proofs (emails) that I did everything I could to raise alert in a responsible way inside the company first.
Edit: after rereading the article I thing we just don't have enough data to know how things happened exactly.
This first part of this is correct (first try through your reporting structure).
The second part is incorrect - it is precisely unprofessional to decide there is nothing more that can be done simply because your manager didn't act, which is what it sounds like you are suggesting.
Details always matter of course, but "well, I tried" is rarely going to be good enough.
Edit: I see the title indicates the person was a "senior" employee but I don't know what that means, since I can't read the article. Perhaps he/she was more than an IC.
On the other hand, often there are lots of options between "do nothing" and "blow up my career".
> 1. Engineers shall hold paramount the safety, health, and welfare of the public.
> a. If engineers’ judgment is overruled under circumstances that endanger life or property, they shall notify their employer or client and such other authority as may be appropriate.