Slashdot Mirror
Are Background Checks Necessary For IT Workers?
4foot10 writes "UBS PaineWebber learned a hard lesson after hiring an IT systems admin without conducting a background check. Now its ex-employee is slated to be sentenced for launching a 'logic bomb' in UBS' computer systems that crashed 2,000 of the company's servers and left 17,000 brokers unable to make trades."
It's not that IT employees are more likely to do bad things than other people; but rather that IT employees are often in a position not only to do more harm when they go bad, but also cover it up better.
You don't need background checks for everybody, just for those employees in a position of significant responsibility and authority.
Any sufficiently well-organized community is indistinguishable from Government.
Yes, of course admins with the ability to wreak major havoc at an organization should have to undergo background checks. Several years ago I worked at a Fortune 500 company, and there were no background checks done at all for IT staff. Turns out we hired a guy who used a fake name and someone else's social security number, and he worked as one of our main sysadmins for over a year, with privileges on probably 100 servers and full privileges on the email servers, before he was caught. I thought background checks were a waste of time until that...scared me half to death because no one had any idea what he'd done in all that time, and worse, no idea who he actually was.
How would this ever prevent a first offense??
The question you should be asking is not, "would a background check have prevented this", it's "how the hell could one person alone cause that much damage on UBS' network"?
One person should not have been able to push a logic bomb out to thousands of machines without several other people in the organization knowing about it. Isn't UBS publicly traded? The Sarbanes-Oxley Act should have required that their IT group be audited to ensure that controls were in place to prevent exactly this sort of situation.
The way that I look at it is this:
Your IS/IT people are less likely to do Bad Things(tm) since there is little or no reward in it for them. Upper levels of managment can embezzel funds, so can lowly finance interns. For them, there is the possibility of stealing millons of dollars over time.
For IS/IT people, what have you really done? It's a larger scale equivalent of breaking a window. You've caused trouble for other people, but there is no benefit to you.
Besides, IS/IT people are easy to keep happy for the most part. Let them have ownership of the network, don't micro-manage them, and buy them the occasional cool gadget. Want a 20" LCD? If the $300 is costs keeps you happy for 6 months, you can have 4. Want the most kick-ass computer in the company? For the $1000 difference it would take, no problem.
IS/IT people are important. They are the ones who know where your data is, how it's organized, and where it's backed up. Their needs are simple too. They mostly do IS/IT work because they like new stuff and gadgets. Throw them a new piece of tech every other month and keep their salaries at least comparable and you won't have to worry.
Disclaimer: I say these things about IS/IT people because I was one, then I managed them, and now I'm happy to just be one again.
I hate to burst your bubble, but here's the reality. You, at 24, probably have a similar knowledgebase and skillset as other applicants for my positions. Since I run a background and credit check against my future employees, I get to pick between someone with the same skills as you and a "clean" record, or you with bad credit, a divorce and and a criminal record. Guess who I'm hiring.
Unfair? No. You're not the sort of person I want working for me. You don't have a stable family life. As such you're more likely to quit/move and give shorter notice when you do. You have bad credit. You haven't demonstrated (regardless of good or bad reasons) to large financial institutions that you're worth loaning money to. I'm less likely to want to give you access to mine. Finally, you're a criminal. Sure, you were a criminal when you were a kid, but, on paper, you're more likely to be a criminal in the future, and that's nothing my company wants anything to do with.
On the other hand, if you've got a great resume, and you stand out, and it's not a tiebreak, we might overlook SOME of those problems.
I sympathize. I have a divorce. Until recently I had bad credit. I got in trouble as a young adult and have a misdemeanor record (reduced felony). I know if I didn't have the skills I do in my special niche of the IT world, I'd be passed over in favor of others. Thems the breaks. It's the price I pay for the mistakes in my youth.
If he lied on his application, a good background check will reveal this. This goes for all employees, from the guy who mops the floors to the guy in the CEO's office. Remember, the guy you hire to mop the floor may be working on his CS degree and become your IT guy in 3 years. 15 years later he may be the CEO.
Catching a liar is much more valuable than disqualifying a murderer or embezzler. The former obviously hasn't learned his lesson yet.
As for protecting your systems from bad acts, keep audit trails. Where necessary, have independent systems log all administrator activity, and make sure those logs get stored in a difficult-to-erase-without-raising-alarms location, like magnetic tape on a machine your admins don't control. Change the tape daily or more and never recycle.
Use the concept of least-privilage. Make sure admins have the tools to do the work they need to do, where they need to do it, when they need to do it, and no more. Critical systems should have multiple approvals required to effect changes.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Yes, I can understand the whole not wanting to hire me because of things in my past. The thing is, is that as I get older, things will start to work out for me. I've settled down quite a bit, and I do have much more stability in my life now than I did two years ago. I learned that in 6 years in IT, nothing comes fast. I don't expect to be a Senior Sys Admin when I'm 26. Maybe when I'm 36 or so, but not now. I'm in a great job as a Jr Level AD/Exchange Admin. I'm happy, I'm learning more each and every day than I did in the year I was in college, and I'm obviously more experienced than most Assoc. in CS degrees coming from the ________ Technical College. I totally understand the need for background. I tried for NACLAC/Secret Clearance back in 2001. Didn't get it then. Tried again this year for a contract job, and I got it. Of course, I had a chance to explain my past in the interview with the investigator. All I'm saying, is give someone a chance to explain themselves if black marks come up. Someone took time with me, and I'm wicked happy they did, or else I'd be in telemarketing.
If exactly 0% of good employees have arrest records, then an arrest record would be a pretty good indicator of malicious intent; while it wouldn't allow you to catch the other 70% of baddies, it would give you pretty conclusive evidence against that 30%.
If, on the other hand, the records for good employees were the same (which I suspect is closer to the truth), then an arrest record (or lack of one) would tell you absolutely nothing about an employee's trustworthiness.
And if the records for good employees were generally higher than for bad ones, then an arrest record would be an indicator in FAVOUR of hiring, not against!
So, worrying as those numbers might sound, they're utterly meaningless here without some context and background!
Ceterum censeo subscriptionem esse delendam.
A background check could filter out a lot of bad people.
Perhaps, but will a background check filter out a person who doesn't have a record? What happens if you piss of your sysadmin (for whatever reason)? You may get a similar situation as UBS. How is a background check going to help you there?
If anything, a psychological profile would be the proper approach. Ask, "Does this person, with a clean record, hold the propensity to go postal (aka, rm -rf *) ?" How many people graduating with a CS or IT degree have a crime-addled past? By and large, very few, I would assume, but that's assuming from experience. Not too many of my coding-nerd/dork/geek friends hold outward, violent contempt towards people. However, some of them seem to harbor a deep-seeded disdain for certain organizations, groups, etc. None of them have ever been in trouble for any reason, but what if you pissed one of them off for any reason? I can't say what one of them would do. Perhaps they would do nothing, short of quit their job, but no one can be certain what _any_ person will do when faced with extraordinary duress.
Personally, I believe if we were to go down the road to psychological profiling, we're treading in dangerous territory. Something along the lines of Minority Report meets Gattaca.
No sig for you! Come back one year!
Yes I have been denied jobs because my credit score wasn't high enough.
I always pay my bills on time but I rarely use credit cards and was a college student until recently so I didn;t spend much. Now employers think I am irresponsible with money or I am more likely to steal because thats what people without perfect scores do bla bla bla.
By law they have to tell you they are doing a credit check. But its a common practice and most employers will refuse to hire unless you agree to undergo one. Yes they have the power to see what your spending habits are as well.
http://saveie6.com/
This is a topic I've been curious about for a few years now. From about the age of 14 till I was 23 I've racked up many misdameanors and felonies as I went through life doing drugs and being a loser. I'm 26 now and have cleaned up since I was 23. I'm a student right now wondering if when I go for an interview or fill out an app if I should lie about my past or put down the truth and hope I'm given a chance. In the past I've lied and gotten many jobs, but its mostly construction, labor, grunt work that nobody ever does a background check on. I actually work in a factory that makes anti-theft boxes for vehicles. And I lied on the app for the temp staffing company that got me a permanent job there because they do not accept felons of any kind. It actually said on the app STOP if yes to question #12. From experience I've found that telling the truth is 99% guaranteed to have your app thrown in the trash. However from what I read here they actually do backgrounds checks and I've seen that in the hire ads at monster, dice, etc. For anybody that knows, should I maybe have low hopes for getting a job in IT because of this?
Should I lie and hope I slip through the cracks and hope some more my past is never revealed?
Should I tell the truth and burn gas to the next interview hoping I'll find somebody open minded?
My record is burglary, theft, dui. Nothing violent or job-related.
Yeah I know I brought this on myself but if I'm never given another chance am I supposed to do manual labor making 9 dollars an hour the rest of my life as punishment?
BTW, at my current job, I see "clean" employees steal things, yet I never do.
Comment removed based on user account deletion
I've worked for a LOT of places - some were banks. My wife works for a brokerage. Trust me, for every one of those jobs, we not only had a regular background check, but were fingerprinted, and the prints run
They actually called my wife back on one of them - at out old house, there was a woman with the same name 1 block away, so our addresses were 1 digit different. That woman had "problems". This has actually turned up 2-3 times, including at our house closing - we had to certify that my wife was NOT the other woman - they took our word, but had to sign a paper
I've held security clearences - they don't prove that you won't do something wrong too - BUT they do tend to get rid of SOME of the chaff - yeah, you lose some wheat too, but...
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso
If you tell me on your application that you are a perfect tenant, pay on time, just moving across town to a bigger apartment, great. But you'd be surprised how many times I pull credit and see the person is from out of state and moved because he's got 12 judgments against him from former landlords, and the local utility won't provide service to him 'cuz he owes them $5,000.00. I'm sorry, but where I live it gets cold, and if you don't pay your electric bill, my pipes are going to freeze and that's more damage than you can afford to pay for, buddy.
So, perhaps that is what employers are looking for. Validation that you aren't totally full of it. I've never heard of someone being denied employment because of a low credit score. I have heard of people being denied employment for lying on their resume or during their interview. "I see from your resume you attended Harvard. Tell me, why did you have electric service in your name in Mississippi and then in Alabama during those 4 years? Correspondence course?"
That's what I use credit checks for.
They don't grade fathers, but if your daughter's a stripper, you fucked up. --Chris Rock