Informing mgt their security is leakier than Luisa Zissman's fanny rag

[bobspud]

The answer should be report it up the food chain and carry on billing however there is the usual politics and blame culture to handle in the senior management team. So you need to balance the email so that you don't get your manager/client shot. If is was me I would draft the email warts and all then send it to the manager that owns the responsibility and ask him to help you phrase it for his bosses consumption. then work on the draft together till they are us happy that you have not screwed them that way they get to take the credit for working with you to identify the issues and raise their game rather than becoming a C-levels Lunch for fun.

Most businesses that have these issues, have them because the C-Levels don't see a need to care about it or rather are more interested in other pressures than firewalls and bad coding.

[chef]

You could always just be nice and go ahead and fix the problem for them and tell no one. Of course, you wouldnt get any recognition, extension and most likely be fired for working on an unauthorised project/system but it would solve the problem of "As a professional in my field of work, do I or don't I write an email or should I first grow a pair"

[Pogle]

Snorted my coffee reading this one!

That was the cleaned up version as well.....

[jmo21]

Is it an exploit that someone outside the organisation could attack/prove?

If so, pass it to a security company and let them expose it.

The you get the best of both worlds, ethical part done, but safeguarding your contract should any snidey management take a disliking to you.

I've been reading Troy Hunt for a while, he's a security expert who "outs" companies with insecure websites

[doodab]

The you get the best of both worlds, ethical part done, but safeguarding your contract should any snidey management take a disliking to you.

Are you mental? Making that sort of disclosure to a 3rd party without obtaining management clearance first would be sack on the spot material in any role I've ever had.