Slashdot Mirror
Why Should I Trust My Network Administrator?
Andrew writes "I'm a manager at a startup, and decided recently to outsource to an outside IT firm to set up a network domain and file server. Trouble is, they (and all other IT companies we could find) insist on administering it all remotely. They now obviously have full access to all our data and PCs, and I'm concerned they could steal all our intellectual property, source code and customers. Am I being overly paranoid and resistant to change? Should we just trust our administrator because they have a reputation to uphold? Or should we lock them out and make them administer the network in person so we can stand behind and watch them?"
If it was really a worry, why outsource it in the first place?
If you're concerned, ask them to carry a performance and fidelity (aka surety) bond.
That's the service they are offering. If you want someone to be on property so you can look over shoulders, hire an IT staff.
For the same reason you trust your accountant.
Tell me, do you trust your sales people with your customer database? In my experience, they're the ones to watch.
That is an incredibly dumb question.
You should trust him because, as the manager of the startup, it is within your area of responsibility to ensure apriori that the people you hire to do this are trustworthy, or you are simply not doing your job and you should be fired and replaced with someone who can. Since your company is already on a path for doing outsourcing, I am sure your job could be outsourced to someone more competent in Bangalore.
-- Terry
Seriously? You're thinking about this now AFTER they've put the whole network up with all remote access enabled?
What the hell makes you think they can't steal all your crap in person? Even if you assigned someone to watch every move they make it would be difficult for novices to even be able to recognize data theft happening as they watched if it happened through a command-line interface.
I would guess that it costs less to outsource this sort of work
That's true. It's mostly a tax and shareholder benefit (you don't have assets and depreciation (CAPEX) instead you have costs and service charges (OPEX)) but it's also true that since the outsourcing company probably works for several other companies they can share costs and normally come in cheaper.
This means that it's a simple calculation in theory. If the extra cost of doing on site administration properly, or at least better than the external company, is more than the value of the information (asset) that might be lost times the chance of it being lost (risk) then forget about it. There's a slight chance might save your company money, but you guarantee to lose it some money.
Simply put; in business, especially start ups; there's always risk. If you have a fire in your office your company is probably dead. Probably there's a key person in your team who, if he leaves, will stop the company working. List all the risks you can think of and handle those risks where you can get the best benefit for the least money. Do that in the cheapest way possible (maybe a contract change will reduce the risk of your administrator to a reasonable level). It is possible that there's some special data where that risk is the system administrator in which case you might be worth adding extra protection. For the rest just accept the risk and move forward.
In the end; you seem to be the responsible manager. You have to calculate the above things to your satisfaction and spend your money to make things work best taking into account all possibilities and not just this one. Since we don't have enough information about the information we can't really help you.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Good point.
Do you trust your accountant to not embezzle from you? Do you trust the rest of your staff to not slack off every time you turn your back?
Do you trust the kitchen staff in the restaurant you ate lunch at to not hork a booger-laden loogie in your lunch?
Do you trust your wife to not fuck around on you? Or your kids to not steal money out of your wallet?
Honestly, if you are so distrustful of those who do work for you that you feel you need to stand behind the administrator and watch what he types, you should really be examining the root cause of your distrust. Asking a contractor what safe guards they have in place to ensure the confidentiality of their clients' information is one thing; feeling the need to stand over somebody's should while they type is just insane.
I don't care why you're posting AC
You're missing something important: if your staff/employees do things that are illegal, they can be prosecuted and imprisoned for it. This is why more accountants don't embezzle from their clients. Kitchen staff has been prosecuted for contaminating food (it's rare, but it does happen).
The same goes for an IT admin who's an employee. If he steals your data, not only can you fire him on the spot, you can have him prosecuted. Going to jail is usually a pretty big disincentive for people in this country who contemplate illegal acts.
But if you outsource your IT work to India (or to someone who subcontracts it to India), you have no such recourse. What are you going to do if they steal it? Sue them? Have them jailed? Good luck with that.
I am a remote administrator for dozens of companies. I have been doing this for many, many years. My business success is directly dependent upon your business success. I have a vested interest in every single one of my customers growing and flourishing in business. As such, I only recommend solutions that are justifiable in direct, easy to understand terms.
You have proprietary information? So what. So does every other company and government agency I do work for - all of which is done remotely. Only on rare occasion do I visit on site.
If you cannot place your trust in the people holding your admin password, then administer it yourself. Otherwise be prepared to pay 2-3 times more for simple administrative tasks.
I'm sure I have access to tons of proprietary information, sensitive information, etc. but so what - I'm an honest guy. If I see the stuff, my first reaction is do we have this properly protected? I know the first reaction in a criminal mind is "What can I do with this?". Criminals don't usually want to work for a living.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
There is some data that a sysad, whether internal or external, should not be trusted with.
Basic system administration should be required for business and management degrees, enough to maintain the disconnected key server and the separated subnet that handles all the most sensitive data.
Small networks are not that hard.
This has got to be the worst idea ever.
Lets take the ABSOLUTELY CRITICAL DATA and have someone who's core abilities are not system administration maintain it. This is more than a bad idea, its incompetence.
Trust your admin, or replace them.
This suggestion above is equivalent to proposing that managers have to learn electrician skills to wire the most important room in the building, for fear the paid electricians might sabotage it, or they have to learn locksmith skils to key the locks on the most sensitive file room, because they can't trust locksmiths not to share a copy of the key or sneak in one night.
The simple fact is the management of key systems should be entrusted to skilled IT professionals whose primary responsibility is maintaining consistent, operational, available systems.
That doesn't just mean setting up systems and forgetting it, it also means implementing secure backups, monitoring audit trails, managing the complex access controls, monitoring system logs, and correcting problems.
Make sure that you have a document to describe how to take back the network in case you decide to fire the IT staff. I used to work in this area, and I provided this to my clients even if they didn't ask for it. If I were looking to outsource, I'd certainly make sure that I had the ability to rip it back. Even if I trust the outsourcing company completely, which is requirement #0 in my book, I want to make sure that my company stays my company.