Slashdot Mirror
Why Should I Trust My Network Administrator?
Andrew writes "I'm a manager at a startup, and decided recently to outsource to an outside IT firm to set up a network domain and file server. Trouble is, they (and all other IT companies we could find) insist on administering it all remotely. They now obviously have full access to all our data and PCs, and I'm concerned they could steal all our intellectual property, source code and customers. Am I being overly paranoid and resistant to change? Should we just trust our administrator because they have a reputation to uphold? Or should we lock them out and make them administer the network in person so we can stand behind and watch them?"
If it was really a worry, why outsource it in the first place?
That's the service they are offering. If you want someone to be on property so you can look over shoulders, hire an IT staff.
For the same reason you trust your accountant.
Tell me, do you trust your sales people with your customer database? In my experience, they're the ones to watch.
There are no dumb questions.
He's here asking for advice, so give it to him. Even though most of the people who read/post this board are heavily involved with IT, and it might be a common sense answer, the fact is that to this person it isn't as simple a solution.
In many cases, people have sensitive information that they are handling on their servers, and whether or not to trust the IT staff is a valid question. (not all geeks are trustworthy). Also, in many cases, (especially with startups) they dont have the resources to hire on-site IT staff, so they have to outsource it. It introduces a dilemma that many will have to deal with.
-T
I would guess that it costs less to outsource this sort of work
That's true. It's mostly a tax and shareholder benefit (you don't have assets and depreciation (CAPEX) instead you have costs and service charges (OPEX)) but it's also true that since the outsourcing company probably works for several other companies they can share costs and normally come in cheaper.
This means that it's a simple calculation in theory. If the extra cost of doing on site administration properly, or at least better than the external company, is more than the value of the information (asset) that might be lost times the chance of it being lost (risk) then forget about it. There's a slight chance might save your company money, but you guarantee to lose it some money.
Simply put; in business, especially start ups; there's always risk. If you have a fire in your office your company is probably dead. Probably there's a key person in your team who, if he leaves, will stop the company working. List all the risks you can think of and handle those risks where you can get the best benefit for the least money. Do that in the cheapest way possible (maybe a contract change will reduce the risk of your administrator to a reasonable level). It is possible that there's some special data where that risk is the system administrator in which case you might be worth adding extra protection. For the rest just accept the risk and move forward.
In the end; you seem to be the responsible manager. You have to calculate the above things to your satisfaction and spend your money to make things work best taking into account all possibilities and not just this one. Since we don't have enough information about the information we can't really help you.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Good point.
Do you trust your accountant to not embezzle from you? Do you trust the rest of your staff to not slack off every time you turn your back?
Do you trust the kitchen staff in the restaurant you ate lunch at to not hork a booger-laden loogie in your lunch?
Do you trust your wife to not fuck around on you? Or your kids to not steal money out of your wallet?
Honestly, if you are so distrustful of those who do work for you that you feel you need to stand behind the administrator and watch what he types, you should really be examining the root cause of your distrust. Asking a contractor what safe guards they have in place to ensure the confidentiality of their clients' information is one thing; feeling the need to stand over somebody's should while they type is just insane.
I don't care why you're posting AC
You're missing something important: if your staff/employees do things that are illegal, they can be prosecuted and imprisoned for it. This is why more accountants don't embezzle from their clients. Kitchen staff has been prosecuted for contaminating food (it's rare, but it does happen).
The same goes for an IT admin who's an employee. If he steals your data, not only can you fire him on the spot, you can have him prosecuted. Going to jail is usually a pretty big disincentive for people in this country who contemplate illegal acts.
But if you outsource your IT work to India (or to someone who subcontracts it to India), you have no such recourse. What are you going to do if they steal it? Sue them? Have them jailed? Good luck with that.
I am a remote administrator for dozens of companies. I have been doing this for many, many years. My business success is directly dependent upon your business success. I have a vested interest in every single one of my customers growing and flourishing in business. As such, I only recommend solutions that are justifiable in direct, easy to understand terms.
You have proprietary information? So what. So does every other company and government agency I do work for - all of which is done remotely. Only on rare occasion do I visit on site.
If you cannot place your trust in the people holding your admin password, then administer it yourself. Otherwise be prepared to pay 2-3 times more for simple administrative tasks.
I'm sure I have access to tons of proprietary information, sensitive information, etc. but so what - I'm an honest guy. If I see the stuff, my first reaction is do we have this properly protected? I know the first reaction in a criminal mind is "What can I do with this?". Criminals don't usually want to work for a living.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
There is some data that a sysad, whether internal or external, should not be trusted with.
Basic system administration should be required for business and management degrees, enough to maintain the disconnected key server and the separated subnet that handles all the most sensitive data.
Small networks are not that hard.
This has got to be the worst idea ever.
Lets take the ABSOLUTELY CRITICAL DATA and have someone who's core abilities are not system administration maintain it. This is more than a bad idea, its incompetence.
Trust your admin, or replace them.
This suggestion above is equivalent to proposing that managers have to learn electrician skills to wire the most important room in the building, for fear the paid electricians might sabotage it, or they have to learn locksmith skils to key the locks on the most sensitive file room, because they can't trust locksmiths not to share a copy of the key or sneak in one night.
The simple fact is the management of key systems should be entrusted to skilled IT professionals whose primary responsibility is maintaining consistent, operational, available systems.
That doesn't just mean setting up systems and forgetting it, it also means implementing secure backups, monitoring audit trails, managing the complex access controls, monitoring system logs, and correcting problems.
Make sure that you have a document to describe how to take back the network in case you decide to fire the IT staff. I used to work in this area, and I provided this to my clients even if they didn't ask for it. If I were looking to outsource, I'd certainly make sure that I had the ability to rip it back. Even if I trust the outsourcing company completely, which is requirement #0 in my book, I want to make sure that my company stays my company.