Hello, this is my first post, apologies if it’s not in the right group.
The company that I work for uses an external service to post monthly wage slips to a portal, each member of staff must sign up to use the service using a personal email account, staff that don’t sign up to the service receive their wage slips via the postal service.
It’s not mandatory for staff to use the service but its highly suggested that this is the way to go when you join and the majority 90% of staff use the portal.
We have identified that the service is not secure enough, i.e it does not employ MFA or any form of complex password requirements, furthermore you can bombard the portal with passwords and it doesn’t have any lockout.
We have told the business that this service does not conform to standards and we should inform staff immediately, recommend that they download their historic slips and close down their account. The business has refused our advice stating it would cost them too much in postal costs if everyone did this.
Clearly ethics plays a big part in me coming here and asking for advice. Can anyone suggest a pragmatic next step?
