in reply to Re^2: Where to get this kindof advice.
in thread Where to get this kindof advice.

It's hard because the company is very white collar clean cut .. just plain white here and there. So .. I have to be very dipplomatic about what we should and should not be doing, and what we can and can not be doing.

No, you don't. You can and should speak plainly. You just have to communicate in terms that businessmen can understand. Speak in terms of risk, liability, and accountability. Those are things that are important in business. Computers, networks, and security typical aren't; unless they impact the bottom line on the company balance sheet.

Specifics to address should include:

1) You're not willing to be held accountable for failure of this system unless you have authority over how it will be implemented. Pointed refuse to take the blame for someone else's business decisions.

2) You're concerned about the risks and the associated costs the company is exposing itself to by it's poor security. Ask for a written explanation as to why they're not adopting a more secure risks-management policy, and point out, in writing, exactly how much money they stand to lose if something goes wrong. If it's a trivial amount, then perhaps they don't care. If it's not (and it's probably not), point it out to them. Remember, businessmen don't care about computers; but they care a lot about money.

3) If you're worried about costs of errors (security settings being set wrong), point that out, as well. Develop best case, worst case, and realistic probable case scenarios, with numbers. Prove your points to the senior management.

4) If they still won't listen to you, object formally. Get requests you disagree with put in writing, then implement them as written. Get clarifications in writing if anything is unclear. Once they formally order you to do something, it's not your decision anymore, and neither is the blame for that decision. That "pulls your ass back out of the fire", so to speak. By getting your orders in writing, you're making the point that you disagree strongly, but will comply so long as your boss takes the blame for his own decisions. If he won't do that, one or both of you should leave the company. ;-)

Don't be afraid to speak up if you think there's a significant problem. On the other hand, be prepared to back up your fears with a proper risk analysis: what you think can go wrong, why it might go wrong, and how those risks would be mitigated if they did things "your way". Learn to make the business case for what you want; it's a skill that will serve you well throughout the rest of your life, even if management rejects it for this project.