Why Should I Trust My Network Administrator? 730
Andrew writes "I'm a manager at a startup, and decided recently to outsource to an outside IT firm to set up a network domain and file server. Trouble is, they (and all other IT companies we could find) insist on administering it all remotely. They now obviously have full access to all our data and PCs, and I'm concerned they could steal all our intellectual property, source code and customers. Am I being overly paranoid and resistant to change? Should we just trust our administrator because they have a reputation to uphold? Or should we lock them out and make them administer the network in person so we can stand behind and watch them?"
Worried about the results of your actions? (Score:5, Insightful)
Worried about the cost of your actions? (Score:5, Insightful)
Re:Worried about the cost of your actions? (Score:5, Insightful)
I would guess that it costs less to outsource this sort of work
That's true. It's mostly a tax and shareholder benefit (you don't have assets and depreciation (CAPEX) instead you have costs and service charges (OPEX)) but it's also true that since the outsourcing company probably works for several other companies they can share costs and normally come in cheaper.
This means that it's a simple calculation in theory. If the extra cost of doing on site administration properly, or at least better than the external company, is more than the value of the information (asset) that might be lost times the chance of it being lost (risk) then forget about it. There's a slight chance might save your company money, but you guarantee to lose it some money.
Simply put; in business, especially start ups; there's always risk. If you have a fire in your office your company is probably dead. Probably there's a key person in your team who, if he leaves, will stop the company working. List all the risks you can think of and handle those risks where you can get the best benefit for the least money. Do that in the cheapest way possible (maybe a contract change will reduce the risk of your administrator to a reasonable level). It is possible that there's some special data where that risk is the system administrator in which case you might be worth adding extra protection. For the rest just accept the risk and move forward.
In the end; you seem to be the responsible manager. You have to calculate the above things to your satisfaction and spend your money to make things work best taking into account all possibilities and not just this one. Since we don't have enough information about the information we can't really help you.
Re:Worried about the cost of your actions? (Score:5, Insightful)
In the end; you seem to be the responsible manager. You have to calculate the above things to your satisfaction and spend your money to make things work best taking into account all possibilities and not just this one.
Absolutely correct, it' all about risk management.
You can't outsource responsibility to your shareholders, though, and that has to be added to any risk equation.
One of the risks that has been rearing its head lately about outsourcing critical data is that data security walls seem to be thinner the further afield you go. It's especially bad where bribery is an entrenched part of the economy. Bottom line: if you don't have good reason to trust your outsourcer then don't trust them with your data. It's the keys to the till and should be as carefully controlled.
Re:Worried about the cost of your actions? (Score:4, Interesting)
Does it cost less than the loss of the IP, in case the outsourced staff is crooked?
Another case of ignoring "risk" when assessing cost.
Re: (Score:3, Insightful)
Re:Worried about the cost of your actions? (Score:4, Insightful)
"IP loss" does not exist. At least not loss of copyright, patent, or trademark rights. If somebody infringes your IP, you sue them. I don't really see what the problem is, unless all of your IP is kept as a trade secret such that third party disclosure completely fucks you. Copyright your software, patent what's patentable, and stop being so damn paranoid. Do you think some company could actually start up, using your software and patented methods, and steal your customers, and you won't NOTICE? Are you just completely oblivious to your own market sector or something?
Spoken like somebody who's never owned any significantly important, private information.
Information leaks can devestate a business, and I'm not just talking credit cards. Let's say that you have AIDS, and somehow, that very private information leaks. Let's say that you are a private school, and you are teaching Nicholas Cage's kids, but under assumed names. What if one of the kids has some kind of mental problem, or is a hermaphrodite? You think that keeping this information free from the prying eyes of the Papparazzi isn't a very, very high priority?
You can build a very nice, successful business simply by making discretion your focus point, adhering to industry & security best practices, and promoting the h*** out of it! If you combine that with a premium technical service, like *nix system administration or mainframe maintenance, you're pretty much free to fill the blank checks they'll give you.
But if you do, don't ever, ever, ever let your security be compromised! I've said this many times: "My basic plan is to get into positions of trust, and then never, ever, ever, violate that trust".
Re: (Score:3, Interesting)
You're a pharma startup. $big_global_pharma_corp steals your research.
Good luck suing. By the time you might get close to getting a positive verdict, your company has been in chapter 7 for long enough that it doesn't exist anymore.
Re:Worried about the cost of your actions? (Score:5, Insightful)
over their actions (the individual admins that is)
Also an in house employee has more to loose if your company is forced out of business due to
the loss of data or I.P.
trusting the in-house admin? (Score:4, Insightful)
There is some data that a sysad, whether internal or external, should not be trusted with.
Basic system administration should be required for business and management degrees, enough to maintain the disconnected key server and the separated subnet that handles all the most sensitive data.
Small networks are not that hard.
Re:trusting the in-house admin? (Score:5, Insightful)
There is some data that a sysad, whether internal or external, should not be trusted with.
Basic system administration should be required for business and management degrees, enough to maintain the disconnected key server and the separated subnet that handles all the most sensitive data.
Small networks are not that hard.
This has got to be the worst idea ever.
Lets take the ABSOLUTELY CRITICAL DATA and have someone who's core abilities are not system administration maintain it. This is more than a bad idea, its incompetence.
Trust your admin, or replace them.
Re:spoken like a true sys-ad (Score:5, Insightful)
This suggestion above is equivalent to proposing that managers have to learn electrician skills to wire the most important room in the building, for fear the paid electricians might sabotage it, or they have to learn locksmith skils to key the locks on the most sensitive file room, because they can't trust locksmiths not to share a copy of the key or sneak in one night.
The simple fact is the management of key systems should be entrusted to skilled IT professionals whose primary responsibility is maintaining consistent, operational, available systems.
That doesn't just mean setting up systems and forgetting it, it also means implementing secure backups, monitoring audit trails, managing the complex access controls, monitoring system logs, and correcting problems.
Re:spoken like a true sys-ad (Score:5, Funny)
Exactly!
If anything, we should be teaching electricians, sysadmins, secretaries, and the like management skills, and going without managers. Costs would be lower, proficiency would be higher, and people would want to come to work on Monday!
Re:spoken like a true sys-ad (Score:4, Interesting)
As far as the poster is concerned, if you are that paranoid learn how to operate your firewall and lock them out when they are not specifically working a ticket, or have a different third party manage the firewall. Have the consultant do their work through something like Webex where the session can be recorded for review, that way you can checkup on them without having to sit there in real time and watch. Personally I wouldn't work for you as an employee or a consultant, but for enough money you will probably find someone willing to placate your sociopathy.
Re: (Score:3, Insightful)
Data is valuable because management thinks it is valuable.
Bribing people to be ethical is probably more effective than attempting to force them to be ethical, but both approaches have limits, and the limits hit a lot earlier than managers want to believe.
Re:trusting the in-house admin? (Score:4, Insightful)
This is a prime illustration of the diconnect between IT and business. If you can't see it, then that's why it's there.
Most business people struggle to turn on a computer. They just want it to work.
Having business educated people in charge of the most sensitive systems, how is that going to improve things. I'd say this is a good way of increasing the probability of putting the fox in the hen house.
If you are really concerned about the security, hire a security group to audit the sysadmins on occasions.
If the security group knows what they are doing they will make an untrustworthy sysadmin very very nervous.
But now you've got to find a competent security group to do that and it's going to cost more money. Which is what the original author was trying to avoid by outsourcing?
Basically, if you can't trust your sysadmin and it really bothers you, then you are screwed.
Working as sysadmin in house and as consultant, I've usually found that those who don't trust me are usually the most unethical or the most power hungry. I usually find that it's best to move on before my tolerance limit is reached.
Re: (Score:3, Insightful)
Money can buy off the 'looking for other opportunities, including selling your data'.
Why do you think people that handle sensitive government information generally have their finances looked at? If you're hurting for money, you might try and pawn something you have access to.
True, some people will just take the money -AND- sell your crap.. some people will also take almost no money, but still not sell your crap.. what you're trying to buy is some insurance and CYA factor.
As for Managers -needing- to learn I
Re:Worried about the cost of your actions? (Score:5, Insightful)
Good point.
Do you trust your accountant to not embezzle from you? Do you trust the rest of your staff to not slack off every time you turn your back?
Do you trust the kitchen staff in the restaurant you ate lunch at to not hork a booger-laden loogie in your lunch?
Do you trust your wife to not fuck around on you? Or your kids to not steal money out of your wallet?
Honestly, if you are so distrustful of those who do work for you that you feel you need to stand behind the administrator and watch what he types, you should really be examining the root cause of your distrust. Asking a contractor what safe guards they have in place to ensure the confidentiality of their clients' information is one thing; feeling the need to stand over somebody's should while they type is just insane.
Re:Worried about the cost of your actions? (Score:5, Insightful)
You're missing something important: if your staff/employees do things that are illegal, they can be prosecuted and imprisoned for it. This is why more accountants don't embezzle from their clients. Kitchen staff has been prosecuted for contaminating food (it's rare, but it does happen).
The same goes for an IT admin who's an employee. If he steals your data, not only can you fire him on the spot, you can have him prosecuted. Going to jail is usually a pretty big disincentive for people in this country who contemplate illegal acts.
But if you outsource your IT work to India (or to someone who subcontracts it to India), you have no such recourse. What are you going to do if they steal it? Sue them? Have them jailed? Good luck with that.
Re:Worried about the cost of your actions? (Score:4, Insightful)
GP makes a great point.
"Remotely" doesn't mean offshore. All big outsourcers - especially those who have large offshore operations - make their offshore staff sign all sorts of confidentiality and privacy contracts. A sysadmin in India is as likely to wind up in jail as a sysadmin here. A worker in a Chinese factory committed suicide just because an Apple prototype got stolen from him.
In addition, outsourcing contracts have liability clauses for breaches. So get the vendor company to agree to liability clauses and protect yourself.
Re:Worried about the cost of your actions? (Score:5, Interesting)
The reason that I don't steal from my employer is not that I could be punished.
It's because I don't steal. Or, rather, because theft is dishonest and wrong.
Re:Worried about the cost of your actions? (Score:5, Insightful)
Yes, that's all good and well, and the reason most people don't steal from their employer or from anyone else for that matter.
However, if you're a potential victim, you can't rely on the honesty of most people to keep you safe, because there's always people out there who aren't honest and will steal from you. That's why most countries have things called "laws" and "courts", to handle cases where someone wasn't honest and didn't care that their actions were wrong. This generally serves to keep people who aren't so honest from pursuing wrong actions (because of fear of punishment), and those who did it anyway frequently get caught and locked up for a while so they can't do it again.
But if you have a situation where there are no effective legal deterrents to bad behavior, as we have in many trans-national situations (because of the difficulty and expense of pursuing legal options outside of your country), then that makes it much easier for the dishonest people to get in and do dishonest things.
Re:Worried about the cost of your actions? (Score:4, Insightful)
Re: (Score:3, Insightful)
Really? If you could steal with absolutely no chance of ever being caught, and no-one being hurt by your actions, you wouldn't do it because of your moral stance?
I wouldn't. That's why it's called a "moral stance". Unbelievable, isn't it?
However, moral stance is not absolute. If the employee in question has a grudge against the company for example, the same principles preventing such actions might suddenly encourage it.
In late-socialist Hungary, everyone felt (and was) underpaid by state-owned factories and the like, and money alone couldn't buy you everything you could need in everyday life, so while people had the same morality as 10 years before, a whole shadow e
Re:Worried about the cost of your actions? (Score:4, Interesting)
Outsourcing isn't always in India. The true and proper term for that is generally off-shoring. Outsourcing simply means outside the company and I am guessing that this outsourcing isn't the kind that goes to India, based on the scale of the outsourcing and the way it was presented in the summary.
-----
I think that outsourcing should be fine because even if you hire your own people they can probably steal the information just as easily and then you don't even have a company to sue, only a person(with far less ability to pay any judgment). Also, I doubt that a network engineer in a firm offering these services has the time to look through all of your shit, find important stuff to steal and find a willing buyer.
If you have some sort of secret formula that can be copied and pasted and is then instantly useful then I would change my statements. Generally its hard to steal something and start a directly competing business unless your business if founded on some sort of extremely simple proprietary knowledge.
Conflicts of interest (Score:3, Interesting)
Here's the thing. If I own a company, I trust my accountant not to embezzle from me and the rest of my staff not to slack off every time I turn my back because I sign their paycheck. I'm paying them good money to act in my company's best interest. Does it work 100% of the time? Obviously, no, because sometimes accountants do embezzle from companies.
However, if I outsou
Re:Worried about the cost of your actions? (Score:5, Interesting)
Seriously? You're saying: "I'm quite happy with whatever you decide" on something core to the business?! So whoever they hire (and let's not forget the idea is to get this as cheaply as possible) is perfectly "OK"?
I worry about this nonsense. I'd want to meet the person, get to know them, make sure they were treated fairly. Before anyone thinks this is a race issue, it isn't - I'm don't care about the colour of their skin, their gender or what what they believe in. I just want someone who seems trustworthy, and someone I know can talk to me if they have a problem. So yes, I want them to come into my office. I want them to be happy. No I don't want to stand behind them watching their every move - I want to trust them.
Re:Worried about the cost of your actions? (Score:5, Insightful)
That's how it works.
When you hire an outsourcing company, you're hiring the company, not it's employees. You do due diligence on the company, it's achievements, it's reputation, and you hire the company. You sign a contract with them, with the same sorts of conditions you'd stick in a regular employment contract to try and ensure that you're going to get what you're paying for. The employees of the outsourcing agency are not your employees and there's really nothing you can do about them because your contract isn't with them, it's with the agency.
That doesn't of course mean you just go with "whatever you decide" on non staffing issues, the company works for you the same way an employee would and you take their advice as appropriate, but who they hire is really none of your business, so long as the company meets its contractual obligations to you. Most of the outsourcing problems are caused by companies not realizing that the outsourcing agency is essentially an employee and not writing stringent enough contracts, or hiring the cheapest option without looking at their ability to actually deliver(which is no different than hiring an18 year old to do a job which requires substantial education and experience simply because you can get them on the cheap).
Not all outsourcing is done on the cheap, sometimes it's done because it's more efficient that way. It's always good to have multiple people with your skill set to bounce ideas off of, and to have backup for absences and the like, but most smallish companies can't afford to have 3 or 4 DBA or sysadmins, etc. So they contract out to another company who, because they provide services to a number of companies, can afford to have more extra people to fill key roles. Their economic situation allows that.
There are advantages to outsourcing beyond just being cheaper, but there are disadvantages to. You don't have the same control of the staffing, you don't have the same kinds of relationships with the staff, and the loyalty of the staff is generally to their employer and not to you. That's not always a huge problem, but sometimes it is, and if it is, expect to have to pay for a redundant DBA or sysadmin so you can keep your place going when they go on vacation. There are pluses and minuses to everything, including outsourcing, and sometimes outsourcing isn't done because it's cheaper, and sometimes when it is, it doesn't turn out to be. When you run your business based entirely on trying to reduce costs, generally you eventually go out of business, that applies to pretty much every field, not just IT our outsourcing.
Something important to do: (Score:5, Insightful)
Re: (Score:3, Interesting)
there is only one real flaw in the slashdot filter by score. it is that this clown is still visible as a -1. I am going to just throw a random comment about adding keyword screening and leave it at that.
Re:Worried about the results of your actions? (Score:5, Insightful)
Mod parent up.
Either you trust your outsourcing company to do what they do how they do it, or you hire an admin to be on site.
Disclosure: I'm an on-site admin, because the company I work for doesn't trust outsiders.
You need an unalterable audit log.. (Score:4, Interesting)
Whether it's an "insider" who works for your agency or an outside contractor, it doesn't matter: either way you have to trust somebody.
The only solution that makes sense is an audit trail that records file transfers and can't itself be modified - which is a real bitchkitty to implement. Does anybody know of any decent products that cover both servers and workstations?
Re: (Score:3, Insightful)
This is all fine and dandy, except:
Trust isn't just about: "Is this {insert expletive here} going to {insert expletive here} me?". It's also is this person up to the job? Are the backups they take any use? (Do they even take them?) How quickly could they get us up and running again? Then there is the basic lack of security inherent in modern IT (which let's face it is laughable) Install a keylogger? Trust is a much more thorny subject than "are they out to get me?"
Re: (Score:2, Insightful)
Exactly - Don't outsource if you are wary about your data.
There will not be any personal responsibility and the consultants working with your IT system will change over time and responsibilities will never stick.
You can end up in a long period of disagreement about what's not in the written agreement while the systems grinds to a halt. And the "paperwork" for getting things done can be horrible. An emergency fix can take ten days and be executed by someone in a different country that has a hard time underst
Re:Worried about the results of your actions? (Score:5, Informative)
Outsourcing to IBM has lead to a 30 to 60 day lead time.
No BS.
To make a change to the software, they need to allocate resources away from all the other companies we are sharing the resources with.
To get new hardware requires 60 days after they get an approved PR. And the cost of setting up that hardware is incredible. $14,000 for a server for example-- more than the cost of the hardware.
Main reasons we do it... Sarbanes Oxley (sp?) and Disaster Recovery. If our corporate office is wiped out, we keep going. If IBM site 1 is knocked down, we keep going. If IBM Site 2 is knocked down- we keep going. Sites 1 & 2 are in very stable, very safe areas of the country.
But our productivity has gone to hell and our costs have skyrocketed.
And YET--- it's cast as a "savings" in the annual reports. Really laughable.
When executives set the rules, they *ALWAYS* make their goals.
Re:Worried about the results of your actions? (Score:5, Insightful)
OH.. the number of times our main office was taken out in the 30 years prior to outsourcing to IBM?
None.
But... it's safer if that 1/500 odds mega disaster hits our area.
Re:Worried about the results of your actions? (Score:5, Interesting)
I wouldn't worry about it. I have this and I work for IBM :)
For example, a recent server we bought internally went up the chain for approval, fell at the last hurdle, back down a different chain to someone else, back across to our team, then back up the approval chain again.
When we got the hardware, no-one had factored in software licenses, so we went through the whole process again while the hardware gathered dust.
We now have an 8 core, 32GB RAM machine simply doling out compile jobs, rather than the original task it was intended for.
Gotta love IBM.
Re:Worried about the results of your actions? (Score:4, Interesting)
This is the difficulty with large companies. Everyone is treated as a "resource" where their availability and work load is fully quantified and estimated several months out. If someone looks under-utilized, they are either assigned secondary responsibilities or made redundant and let go or shifted elsewhere.
So every project has an estimate. Every estimate is padded so that we are sure to meet our goal of being correct within +/- 15%. That is, no one cares how long it takes but if you take longer than you SAID, you're costing the company money. Then they look at the worksheets (undoubtedly the one management type who knows a little about Excel made a template for you to put numbers in). Juggle a bit, rearrange, justify, have some new numbers, and provide an estimate to the client.
Now, instead of using "agile" methods and getting something done as soon as possible or for as little cost as possible, you have all of the planning and overhead that it takes to get an estimate, and engineers sitting around waiting for approvals and also sitting around waiting to announce completion in order to be close to their estimate. Then you're slightly under due to some other team, so next time you estimate higher. You could do it in under 4 hours, but you know you'll have to wait for security clearance (1 week), maybe for the servers to be built (one week), time to get something officially reviewed by some gate (1 week), lots of other things. Bill time for everyone involved and suddenly the costs are through the roof.
If a company quantifies everything about its operations, it's spending too much time in overhead and not enough time actually working. I'm seeing it right now at a fortune 50 company - we fire all of the people who do work, double up work on the remaining people, and the overhead gets more burdonsome because everyone wants to have good numbers. So I have to track everything I do, every minute of every day, regardless of whether my activity is internal or client-billable.
Large companies intent on outsourcing are quite possibly the worst idea ever. Small companies dedicated to a single operation are a much better idea, because people are on the same page as far as what is expected and how long things should take and what the policies are. And there are fewer levels of management to request charts and graphs and such. I actually worked for several years thinking Dilbert was exaggerating things a bit, but I recently saw the light. Go with a small, dedicated company - not a behemoth jack-of-all-trades master-of-none.
Re: (Score:3, Informative)
The servers are mid-high end stuff-- about $10k.
When we used to do them, the first one would take about 3 weeks to set up-- and the rest about 3 hours each.
The costs are doubled (or more) if it is a high availability project- because then the same hardware/software are duplicated at both sites. More if mirroring is required.
Re:Worried about the results of your actions? (Score:5, Insightful)
Basic advice: Make sure your CONTRACT specifies what they can and can't do.
If they break the contract, they (and anyone they did it on behalf of, including if they sell the info to some competitor later) are in for a world of legal hurt.
You agreed to outsource this rather than hire someone to do it in-house. Either cough up the money on lawyers to make sure your butt is protected legally, or hire someone yourself who works just for you and is directly accountable to you.
Re:Worried about the results of your actions? (Score:5, Insightful)
Re: (Score:3, Funny)
Sounds like someone is improperly prepared to start up their business then...
On site is more expensive (Score:4, Informative)
You could mandate on-site support only, but you will get charged out the yang for it.
Re: (Score:3, Insightful)
"Seems fair. Personally, i don't see why a company should refuse to do all service on-site."
Probably because the whole story went untold. While it can be true that small IT companies might not have the head count to offer on-site to their clients, I'd bet the untold part of the story goes more or less like "the company refused to service on-site for the peanuts I offered". Given that 8x5 on-site outsourced (I think that's the option he was looking for) will usually be overall more expensive than a direct
This is what being bonded is for (Score:5, Informative)
You get what you pay for... (Score:5, Insightful)
That's the service they are offering. If you want someone to be on property so you can look over shoulders, hire an IT staff.
Re: (Score:3, Insightful)
But it all comes down to trusting your staff.
In the case of outsourcing it also comes down to trusting your outsourcing providers staff. These are people you did not chose and have no particular loyalty to your company. Further you have little knowlage/control over how they are treated. There may also be far more of them than if you had a dedicated IT staff.
Re:You get what you pay for... (Score:5, Interesting)
Does the original question asked check their employee's bags every night for confidential documents? Mandate no USB drives?
I worked for a small business that started doing crap like that. The lead programmer brought in his own laptop to work on, instead of the crappy machines the boss had laying around. Then *I* brought in my own laptop to work on (which, while orders of magnitude crappier than the lead programmer's laptop, was orders of magnitude better than the crappy desktop the boss had allocated for me). My productivity immediately doubled (larger screen, faster processor, and more RAM help immensely when you spend your day mangling delimited data files).
Fast forward to several months later. Of the six employees in the company (including the boss), three of us were bringing in our own laptops. The boss, the lead programmer, and myself. Out of nowhere, we get an e-mail from the boss saying: "Due to a client's security concerns, employees are no longer allowed to bring in personal laptops. Except [the lead programmer], because he needs it." (He also banned iPods, a policy which only affected the other peon employee.) Never mind that we were still allowed to connect remotely from home with full access to the entire network.
That's fine and all, if a client really did request it... but I asked the lead programmer about it, because he was in the meeting during which this policy was supposedly decided upon. He claimed it was never discussed, and he had no idea where it had come from.
I sent an e-mail to the boss about it, telling him that because switching to my personal laptop had increased my productivity dramatically, prohibiting me from using it would result in a corresponding decrease in productivity that would be quite beyond my control. He didn't seem to care. I never did figure out why he enacted that policy.
Re:You get what you pay for... (Score:5, Interesting)
He enacted that policy because it probably dawned on him that he had no way to enforce whatever the company has in its Acceptable Use Policy (assuming there was one) because they don't own it.
I'm dealing with this issue where I work: Some of our engineers have decided that they can't live without their Macs, so they use the ones they own at work, bootlegging copies of Windows XP, Office, etc. to run under Parallels. Their managers turn a blind eye to it, because it "saves the company money", but it creates a potential liability for the company: We can't enforce the company's AUP, which states in part that we do not condone copyright infringement in the workplace, because it's not our hardware.
I had one remote engineer complain to me about his laptop crashing... and then he mentioned that he'd wiped the hard drive and installed Windows 7 RC. WTF?!? Who uses a beta OS for production use? Fucking idiot.
I don't care anymore - everyone shits on MIS, especially the technical employees, who all secretly (or sometimes not so secretly) think that they can do it better... except that they're too busy, of course. And these same people are the ones that act as though the company's Internet access exists for their personal entertainment, and whose computers end up infected with all the latest malware because they absolutely *have* to be local Administrator equivalent full-time on "their" laptop (something that none of us in MIS here do anymore, by the way, and haven't for years), and disable or uninstall the corporate antivirus software... and a few of them have asked for Domain Administrator rights... no fucking way. And they won't backup even their work data, despite the fact that they've been given the means to do so easily, and if they want, we'll issue them an external USB hard drive so that they can do it at their convenience.
One lawyer decided that he didn't want to wait for the automatic data sync that takes place for laptop users after logging in when connected at the office, and unbeknownst to us, took it upon himself to move his documents folder... hard drive died, and the backups on the network were over 6 months old. The backups of all of his current work documents relating to pending litigation, etc., which represents literally millions of dollars to the company? All more than 6 months old, and useless. Why, the backup must have stopped working, he said... Bullshit - that's why God made logs, and why we keep them. I cheerfully pulled them for the past 6 months, and proved that the backup was working, but that no current documents were getting backed up because there were none to back up... and after we got the USB hard drive with his recovered data back from the data recovery company (and almost $3K later)? There was his data folder, right where he'd made it, off the root of the drive - imagine that. Vindicated, I gathered up all of the evidence, emailed it to my boss, and let him handle it.
And I guess the end of this little rant is this: You know, you might well be smarter than me, better than me, etc., etc., ad nauseum. Good for you! But, I'm damned good at my job, and take pride in doing it to the best of my ability, even after 20+ years, and knowing that so many of you think that I'm incompetent, stupid, ignorant or all three, and believe that you're special and don't have to abide by the company's rules.
And if that sounds more than a little bitter and antagonistic - well, it is: At my company we run MIS as a service to the users and the company, and do our best to keep everything working well and available to everyone, working long, unpaid hours sometimes to do so, responding to pages 24/7, because we know how important the network is to everyone, and that it's our job to keep it running and available. We keep "hot spare" computers, at least one for each model in use, so that we can minimize downtime if someone's breaks, handling the repair after getting them back up
Facepalm. (Score:5, Insightful)
Either that, or learn to do it your damn self.
Obviously you want to find someone reputable, and bonded, but you're never going to get to a point where you can have a network infrastructure that is secure from the people who do your network infrastructure.
I've had enough experience with paranoid managers who hysterically insist that I'm reading their email, or their online banking passwords and crap like that. You think that some schmuck who is working fixing problems remotely really gives a crap about the plans for your Facebook-killer? Think that they care about your boring ass emails? You think they care about your customers??!? Are you kidding? You obviously don't sell networking, so what would be in it for them? Selling a customer list is like selling a used phone book.
No outsourced company is going to send a person to your building every time there is an issue, and frankly, you don't want them to because they'll charge you out the ass for that sort of service. Even if you did decide to pay the price for in-person service, anyone who is out to screw you will be able to screw you while you're watching them over your shoulder, because you won't know what to look for.
If it's really that important to you, bring it in house. And, word of advice, if you do bring it in house, don't treat the guy like a criminal or he's going to start reading your email.
Re:Facepalm. (Score:4, Insightful)
Either that, or learn to do it your damn self.
Right, and it's not just an issue of outsourcing. The reason you should trust your network administrator is that you *have to* trust your network administrator. Whether it's in house or outsourced, you have to trust someone to do the work. The only alternative is to do it yourself-- like literally you, personally.
If I'm your network administrator and I come into your office and work for you directly, I could still read your emails, steal your IP, etc. You could ask me to set up the security so that I can't do that, but you still have to trust me to do that well and not leave a back-door for myself. Also, you should understand that it might inhibit my ability to do some things. For example, if I encrypt your disk so that I can't even access it myself, and then you lose the password, I won't be able to recover anything on your hard drive. Sorry.
So that's the deal. You can try to institute some checks and balances, but there's a certain amount of trust inherent in the job. If you're concerned about security, then make the effort to find people that you can trust, and recognize that you might have to pay extra for better employees. It's an issue of what your priority is when you hire someone (or hire an outsourcing company). Which is most important, getting the person you trust most? Getting the person with the best resume? Getting the cheapest solution available?
Those might be 3 different people. Under most circumstances, I'd pick the person I trust.
You've got to be kidding (Score:4, Insightful)
At some point, you're going to have to trust SOMEONE
Can you trust your Significant Other not to get all stabby when you are in bed sleeping?
Can you trust the drivers on your commute route not to suddenly get out their guns and start shooting at you?
It's all risk management. If you have super-important data, then don't farm out the management to someone you don't trust. If you have regular data, then farm it out to basically anyone.
SH*T happens... but if you are paralyzed with fear that bad things are going to happen because nobody is as trustworthy as yourself, you aren't going to be leaving your house.
Re:You've got to be kidding (Score:5, Insightful)
Can you trust the drivers on your commute route not to suddenly get out their guns and start shooting at you?
You obviously don't live in Chicagoland.
Comment removed (Score:4, Insightful)
that's a myth (Score:5, Interesting)
Knife crimes are reported sensationally in England but it's false that knife crimes are increasing dramatically -- see here [guardian.co.uk] for example. Knife crime has remained relatively stable over the past decade, most recently actually dropping by 15.7%. Maybe you're confusing knives with umbrellas?
You should trust them (Score:5, Insightful)
Tell me, do you trust your sales people with your customer database? In my experience, they're the ones to watch.
Re:You should trust them (Score:5, Insightful)
Absolutely. The sales people have an existing relationship with your customer; knows the guy by name, knows about his kids, his dog, his business needs. They will turn that around on you in a fricking heartbeat.
Sales is a mercenary business. Your competitor offers more money, they'll take it.
Re:You should trust them (Score:5, Insightful)
Except that my accountant has her CPA - a real life honest to god certification. (Not the take-a-class-and-take-a-test mickey mouse 'certifications' of the IT industry.)
She also has a code of ethics, belongs to a serious professional organization, and has a body of law that restricts what she may or may not do and an oversight organization over the top of all of that.
Pretty much none of which IT 'professionals' have.
Re:You should trust them (Score:4, Insightful)
BS. Your accountant is bound by US law. If he embezzles your company's money, he goes to jail.
If your outsourced IT contractor's Indian subcontractor sells your data to a Chinese competitor, there are no legal repercussions for them.
That is an incredibly dumb question. (Score:5, Funny)
That is an incredibly dumb question.
You should trust him because, as the manager of the startup, it is within your area of responsibility to ensure apriori that the people you hire to do this are trustworthy, or you are simply not doing your job and you should be fired and replaced with someone who can. Since your company is already on a path for doing outsourcing, I am sure your job could be outsourced to someone more competent in Bangalore.
-- Terry
Re:That is an incredibly dumb question. (Score:5, Insightful)
He's here asking for advice, so give it to him. Even though most of the people who read/post this board are heavily involved with IT, and it might be a common sense answer, the fact is that to this person it isn't as simple a solution.
In many cases, people have sensitive information that they are handling on their servers, and whether or not to trust the IT staff is a valid question. (not all geeks are trustworthy). Also, in many cases, (especially with startups) they dont have the resources to hire on-site IT staff, so they have to outsource it. It introduces a dilemma that many will have to deal with.
-T
Re: (Score:3, Funny)
"There are no dumb questions."
Oh, yes there are. I remember in college that we all had a laugh when each and every professor told us this. Problem was this guy who was really good at learning things but had zero capability for performing logic thought. And this being a computer science study, we sure had a lot of fun when the professors subsequently tried to explain things to him after his "not dumb question".
Re:That is an incredibly dumb question. (Score:4, Insightful)
You can't tell a story like that and just leave out the stupid questions.
Re: (Score:3, Insightful)
It also has me thinking about a boss I had who went nuts when he found out I could read his email. He wanted his own email server (and like who is going admin it?).
And see, had he asked that question (maybe not in front of slashdot, but at least someone who had a clue) that would have been better than what he did.
In any case I have to wonder about the future of this startup is the people involved are so inexperienced.
It sounds to me like he's trying to become at least a little less inexperienced. And we're calling him an idiot for it.
Don't trust them unless you meet them (Score:3, Informative)
I do a lot of remote support for my customers.
I also make sure I get face time with them.
Learning the work-flow of a company is very important when it comes to administering their network.
If the company you are hiring doesn't schedule regular visits than i wouldnt trust them to work in your best interests.
I'll add this as well. audit them periodically. Hire another company to check up on them.
My customers do this and I've received good feedback from the customer and the auditor.
If you can't trust your admins you're screwed... (Score:5, Informative)
Seriously? You're thinking about this now AFTER they've put the whole network up with all remote access enabled?
What the hell makes you think they can't steal all your crap in person? Even if you assigned someone to watch every move they make it would be difficult for novices to even be able to recognize data theft happening as they watched if it happened through a command-line interface.
You could split the difference... (Score:2)
Hold them accountable. Track everything they do, and audit that it was in fact necessary and honest. Get a contract that holds them liable for damage they cause.
Outside of these terms, I'd suggest that you are absolutely right. The IT company that I cut my teeth under would have had no oversight of this kind of access whatsoever. Their employees would have been accessing your files from home, for kicks, in-between rounds of Unreal Tournament.
On a side note, aren't you legally obligated to monitor this a
Re:You could split the difference... (Score:4, Insightful)
Yup, you're a "manager", that's for sure. The post was about data access trust, not whether they're doing the job. Do you think an audit report is going to say sniffed network, copied browser caches, installed key loggers?
Relative Risk (Score:2)
Security is important, but there can be a tendency for entrepreneurs and startups to over-vector. Pick a respectable vendor. Trust them, and keep an eye on their work.
Rethink Earlier Choice of Outsourcing (Score:4, Insightful)
Who do you trust? (Score:4, Insightful)
Do you trust your bank with your money? Even though they don't keep it at your business and you can't stand behind them and watch what they do with it? Your fortune is at stake. Why do you trust them?
Do you trust your grocer to give you clean, fresh meats? Even though you can't go in the back,
see how they're stored and watch them being cut? Your health is at stake. Why do you trust them?
Do you trust your pharmacy to give you the correct medication? Even though you dropped the prescription off, will pick it up later and don't know the look of one pill from another? Your life is at stake. Why do you trust them?
I trust I've answered your question.
Re:Who do you trust? (Score:5, Insightful)
No, you haven't. The answer to the first question is FDIC. The answer to your second and third questions is the FDA. There's no such regulatory agency for IT.
Re: (Score:3, Insightful)
Incidentally, my butcher has a visible thermometer in the case (and based on the feel of the meat, it's right) and cuts it right in front of me. And it's actually pretty easy to use pill markings to look up what it is.
Re: (Score:3, Interesting)
Do you trust your bank with your money? Even though they don't keep it at your business and you can't stand behind them and watch what they do with it? Your fortune is at stake. Why do you trust them?
Do you trust your pharmacy to give you the correct medication? Even though you dropped the prescription off, will pick it up later and don't know the look of one pill from another? Your life is at stake. Why do you trust them?
Yes, because they are regulated industries and professions, they are well understood (we've been doing banks and pharmacies for many decades), we've worked most of the kinks out. IT/computers/etc. on the other hand is still in it's infancy (and may always remain so due to the rate of change). We're making it up as we go.
What does your legal agreement with this firm say? (Score:2)
What does your legal agreement with this firm say?
Right out from under your nose. (Score:4, Funny)
It's really simple. (Score:2)
Look, it's really simple: If they give you the creeps, don't hire them. Go with someone who is not insistent on administering your network remotely, or who you are otherwise comfortable working with.
Inhouse Servicing for Outsource Pricing? (Score:5, Insightful)
You seem to be conflicted. You don't want to have inhouse IT, but you want them there and available anytime you need them onsite. I think you first need to determine which is important: reduced costs of outsourcing (And all the issues that goes with it) or the improved service of inhouse (and all the issues that go with that)
Even if they're onsite, are you going to have someone paid to stand over their shoulder and watch? if so pay that person to do the damn work for ya.
To be honest your probably safer with an outsourcing company since no sane company would risk their reputation by stealing your "zomg important" secrets.
Why should you trust them? (Score:2)
What's the moral of the story (the real moral, not the 'story for kids' moral)? Don't put someone in charge of your stuff if you d
Wrong question (Score:2)
Remote access is secure - SSH, RDP, decent VPNs are fine for remote administration.
If you don't trust the admin if you don't have them in your direct line of sight, why would you trust them if you're out of the room temporarily?
If you don't trust them when you're not looking over their shoulders, why do you trust them at all?
Either you trust them - and where they are sitting is irrelevant to that question - or you don't. If you don't trust them, fire them and get someone else you trust. If you don't trust
You shouldnt... (Score:3, Insightful)
Nobody should trust their BOFH.
Sadly, it just happens to be the case that we can't live without them, but trustable as a group, they are not.
Trust people, not jobs.
Contractual obligations (Score:4, Informative)
Curious (Score:4, Insightful)
And you come to slashdot to ask that question?
Start by hiring someone with real business talent to run it for you because you sound like your own worst enemy.
IF YOU CAN'T TRUST THE PEOPLE YOU HIRED THEN WHY DID YOU HIRE THEM?
Have you ever considered... (Score:5, Insightful)
Would you be able to see over their shoulder? (Score:3, Insightful)
An atttacker, even a modestly skilled one, given the level of access an admin would need, could do all sorts of terribly serious things in the blink of an eye, whether or not you are watching him. When I'm wearing the admin hat, I routinely run executables on numerous client PCs, manipulate server settings, write and run scripts that gather all sorts of data, make backups, and so forth. Are you really going to be able to see the difference between me tarring the contents of your OMG_Sourcecode directory for backup and me tarring for backup && sneaking a second copy somewhere? And, if you are that good, why are you hiring me to sit there while you watch me, when you could just do it yourself?
If you are paranoid enough, you can use some sort of intrusion detection/exfiltration detection setup, with shell logging, and firewalls, and disabling usb mass storage devices, and uniquely barcoded hard drives, and cavity searches, and so forth; but somebody you trust will have to build that as well.
Obviously, going to Shady Bob & Pradep's House 'o Discount Outsourcing is a bad plan; but so is hiring Shady Bob to work onsite. I'm less sure, though, that there is a significant security difference between offsite and onsite people of otherwise similar levels of cheapness and shadiness.
Do you want a professional or a peon? (Score:3, Insightful)
You really need to ask yourself if you want a professional or a peon? You write your question as if you want someone you can piss on, that tells me you want a peon. Heck, you'll save money on the peon, you can get one from any local technical college, they might even know what they're doing.
If you want a professional and don't want to pay for one, your outsourcing some part time work. You get a portion of a professionals time, that makes you a part time customer, a small fry for the outsourcing company. They are essentially offering a courtesy to you at all to work on your network in the off chance your company grows as this will leave them in a good position.
The bottom line is that professionals that live in your country need to be trusted, they have to much to lose. Most professionals will undergo a background check one to every two years. No professional is going to destroy their livelihood by leaking something like your customer list. No professional is going to risk going to prison or getting sued for crossing the line as long as they live in the same country as you. They will lose their ability for references. Outsource to India and the like and all bets are off, there's no reputation to maintain.
Really, the question is why would your customers trust your company, and is a professional service really any different?
The biggest problem is that the vendors you are talking to are being honest and setting your expectations and you don't like what your hearing. Your about to discover how every extra service has an additional charge and you'll quickly bury yourself in extra fees in the event your company does grow. If you want to position yourself for growth and don't want to be sunk under a slew of fees you should hire a professional in house and then trust them to do their job.
Would you know trouble if you saw it? (Score:3, Insightful)
You say "Or should we lock them out and make them administer the network in person so we can stand behind and watch them?"
Given that you aren't administering your own network, I'd guess that you don't have the skills to do so. Would you know trouble if you saw it?
Would you know enough to see them setting up a remote service that they could get back into? Would you know enough to catch them copying sensitive files from where-ever they live to some staging directory, then later copying that directory off to a flash drive, or to some external server? Would you be able to catch them downloading a root kit and installing it?
In short, given that you don't have the experience to admin your own gear, do you REALLY think "standing behind them and watching them" is going to do anything but waste your time?
And IF you have the skills to admin your own machine, but want to outsource that due to some idea of "I have better things to do than this" - you have the time to stand behind them and watch them do the work, does that not imply you have the time to do the work?
Like others have said: If you are concerned, make them put up a bond.
From the Admin side (Score:3, Informative)
I own a company that does outsourced IT support. Were it us, I wouldn't insist on being able to do remote support - but you'd pay so much for on-demand on-site support you'd be better off hiring someone in-house to do the job instead. The reality is that (were it us) we'd be coming in to your office periodically (depending on your size, from maybe once a month to as much as a couple of times a week. And most of the routine requests you will make we'd take care of by logging in remotely to deal with them for you. In most cases, we can log in and handle it a lot faster than we can free up enough time in someone's day to get them over to your office.
That's the reality of outsourced IT. You can get very good coverage that way, and any good company will give you face time with whomever is handling your account. I've got a lot of clients that trust my employees (and me) with their keys, passwords, and all the lot. I've got professional liability insurance, and a reputation that's even more important to me. If we were the company doing your support, I'd gladly sign an appropriate document guaranteeing we'd keep your data private.
I'm not pimping for my company (you're probably nowhere near where I work - else I would likely have been contacted as one of the firms bidding) but most companies like mine work that way. That's how we can do good work and still be affordable. But the reality a lot of these posters have pointed out stands: if you can't trust an IT company to handle things for you, then hire an admin in-house.
Why is local more secure? (Score:3, Insightful)
I'm unclear as to why you think having them work onsite is more secure. The statement "administer the network in person so we can stand behind and watch them" implies that you have network skills at least as great as they have. In which case the watchers can do the work themselves.
Would you really notice if I ran a batch file that planted a trojaned your computer and uploaded your SAM file(s)? I doubt it. Your IT guy knows everything; that is just a fact of life. Hire a professional and it won't matter. Or you can hire Geek Squad level. Just plan on those "private" pictures of your wife to be added to his personal collection.
I also suspect that you might be hobbling yourself in other ways. (Unless your are geographically isolated or have a non Mac/Windows environment) there is a large number of consultants who will do on-site work. I know; I'm one of them. You will pay more, but there are some situations that require hands-on support. It is very hard to replace a power supply over a VPN connection.
Good luck, and I'm glad you're not my client.
Are they bonded? (Score:3, Informative)
Such a service should be bonded, by an outside bonding company. It's the surety bonding company's responsibility to run background checks on the contractor's employees, and to pay up if they steal. (They'll try to get the money back from the contractor or the employee.) Banks carry surety bonds for their employees.
Here's a contract for network administration services with a bonding clause. [carrollcountyga.com]
About trust and IT administrators (Score:4, Insightful)
I worked in IT for about 15 years, and always held that if a company doesn't trust its network administrators for a justifiable reason, then those people shouldn't be the network admins.
Remote/local doesn't matter. If they are not trustworthy and you can document why, then don't make them your admins. If they are, then don't worry about it until they do something to violate that trust. And if they do violate that trust, then go after them guns a-blazing (figuratively, not literally, OBVIOUSLY).
Most network admins want to be trusted - and need to be. Being untrustworthy is the kiss of death in that entire career path.
As others have said, local or remote doesn't matter. In-house or outsourced doesn't really matter. You need to accurately assess their trustworthiness and then deal with it in an appropriate manner.
Why would you automatically trust on-site IT? (Score:3, Insightful)
There seems to be an assumption that you can "keep an eye" on an on-site network administrator, and that's why you can trust them.
How would you tell if they were up to no good? Will you be looking over their shoulder constantly?
I have worked in medium size IT shops (appro 100 people), and have seen the system admin team all stand around a computer as they go through their manager's CV (they had left it on there home drive). This was practically outside the manager's office, but you can't be everywhere at once.
Maybe you assume that you will only hire trustworthy people, but how can you tell if you can trust someone just by working with them?
Personally, I think the bigger risk to your operation will be if you hire a bad sysadmin.
Owen.
CYA. (Score:3, Informative)
It's interesting that the realization comes after the ink has started to dry on the proverbial paperwork.
As others have already pointed out, you have to choose what you are willing to put up with. No solution has zero issues or problems, just different ones.
In all cases, your risk of data/ip theft? Greater than zero. It will never be zero, short of you getting all copies and all peoples who have had contact with it and lock them in an underground room for all eternity.
* Presumably, you have some form of agreement(written contract) with the outsourced IT group. If you don't, you should _address_ that issue.
* You should have insurance for your company, so that in the event of fraud, theft, etc... and your business goes belly up, you have the means to cover your debts.
* You should be just as equally concerned about data loss as you are about data theft. Ie, make sure you have enough copies of your data/IP.
Regardless of whether you have in-house staff or outsourced staff, you should have some means of auditing your environment to address and reduce the risks involved. If nothing else, it will give you visibility into the types of areas of knowledge that someone other than your IT admin would know and be able to pick up the pieces should one of the problem scenarios appear.
Assuming you decide you are happy with your current support situation, get them to produce a human readable run-book for you, so that should they go out of business, bail, or otherwise default on the agreement, you will be able to bring someone in to take over. Schedule time for someone other than the primary support person to use the runbook to perform downtime/maintenance tasks/etc with the runbook. If there are any issues or problems, have the outsourcing company update it. Make it part of the understood and written agreement. You want to be able to rebuild, in the case of any failures.
Quick summary:
- validate/verify terms of agreement with existing IT support partner
- affirm creation of run-book with support partner and verify that it is valid and up to date with regularly scheduled DR/maintenance tasks
- have an on-site "intern" learn the tasks and serve as your in-house backup IT resource. Presumably, this person can also do double duty, if they happen to be a coder/content developer/PM with prior admin experience, etc. That person is your plan "B". This makes the runbook that much more important.
- NDA(s) and the legal expertise on retainer will help alot in terms of enforcement and collection on damages, but it will not prevent theft.
- Know what your company's plan "B" is in case of theft. Should you be segregating your information? Should you be encrypting your communication? Is the fact that some of your coders are bringing in USB flash devices and bringing work home a problem in your mind in relation to remote IT support?
There are plenty of issues and potential areas for IP theft/leak/sabotage to occur.
Legal agreements will help you when dealing with another company entity, but those legal agreements will do precious little if the theft/release of your IP causes your business to go down the drain.
I'll say it (Score:3, Insightful)
My response is one of many just like it, but bottom line is you HAVE to trust your network admin. Whether he's on site or off, he has access to your stuff. And frankly, I don't care if anyone walks in and sees what I'm doing randomly, but outside of a performance evaluation, the day anybody steps into my office and starts watching what I'm doing is the day I quit.
Are you deciding this now or have already done it? (Score:3, Informative)
You used the past tense. Therefore I see that you've already made the decision to do this and have executed on that decision. The agreements are signed and the admins are working on managing your systems as I write this. A lot follows from this having already gone down. In other words, this detail important to clear up before proceeding because there is a large difference between something you have not yet done and something you have already done and now have to live with.
Of course they all do. Look at this from their perspective: many organizations hire them to do what you hired them to do. None of these IT admin firms have the staff to do things in-person (as you later contemplate threatening upon the firm you hired) where people expect explanations and instruction while they do what you hired them to do (which, by the way, makes everything take at least twice as long). If you wanted teachers to train your staff, you should have hired said teachers. If you wanted something different, you should have considered this before you contracted with them. Be here now. Best to focus on where you are now and proceed from that point realistically.
Your so-called intellectual property [gnu.org] isn't the issue here, you've crossed that bridge. Your issue is you have post-commitment jitters about something you apparently didn't think through. Since you've already inked the deal, it's time to trust your new partners and understand that you don't have the power to "lock them out" in any way that wouldn't constitute a breach of contract or at least erecting circumstances that make them want to get rid of you as clients. You don't have the power to "make them administer the network in person so we can stand behind and watch them" nor would they likely want you to do that. You need to think ahead this time and consider the ramifications of being watched; I'm almost sure you wouldn't want to work that way because hardly anyone wants to work that way. Why would you think they'd want to work that way? You've described nothing unprofessional or bad on their part, so you have no cause to treat them as you describe.
Chalk it up to a lesson about thinking through the details before commitment.
I do this for a living. (Score:5, Insightful)
I am a remote administrator for dozens of companies. I have been doing this for many, many years. My business success is directly dependent upon your business success. I have a vested interest in every single one of my customers growing and flourishing in business. As such, I only recommend solutions that are justifiable in direct, easy to understand terms.
You have proprietary information? So what. So does every other company and government agency I do work for - all of which is done remotely. Only on rare occasion do I visit on site.
If you cannot place your trust in the people holding your admin password, then administer it yourself. Otherwise be prepared to pay 2-3 times more for simple administrative tasks.
I'm sure I have access to tons of proprietary information, sensitive information, etc. but so what - I'm an honest guy. If I see the stuff, my first reaction is do we have this properly protected? I know the first reaction in a criminal mind is "What can I do with this?". Criminals don't usually want to work for a living.
No choice. (Score:3, Insightful)
Either you trust your sysadmins or you don't give them the access they need. Administrators require access to all of your files, your network traffic, your email, your financial data. Not all of the admin staff needs it, but at least one of them does need some access.
The problem with outsourcing is you are treating sysadmins like janitors, a necessary evil farmed out to the lowest bidder. Where the reality is the function is a critical professional appointment which requires vetting, just as you would your accountant and lawyer.
I agree, poster must be kidding (Score:3, Interesting)
You don't outsource to a random idiot -- that's step one. Welcome to referrals. Ask a friend, or a competitor, whom they've used. At least that way, if the IT guy screws you over, he loses more than just you.
Second, hopefully you have NDAs with your clients. Those NDAs undoubtedly say that you have to have an equivalent NDA with your contractors. So make your IT guy sign an NDA.
Third, "stand behind and watch him"? Are you nuts? Not only are you not going to actually do that, but if you did, are you going to read every command? Are you going to understand them? You can watch a magician, or other slight-of-hand artist as much as you want -- most of them depend on your trying to pay attention.
3 letters (Score:5, Insightful)
Bear in mind that there's nothing to stop an angry local administrator stealing/selling data, and being more intimately involved with the company's business activities, he probably knows better where to look.
But, I'd suggest not outsourcing if posssible for a different reason. It normally doesn't work. The lack of local site knowledge is hugely detrimental to knowing wtf is going on. I was with a large aussie mining company that tried it - after 18 months they couldn't get away from the outsourcer fast enough. Main problems are that there is usually no continuity in who deals with a problem, no sense of personal responsibility, no problem ownership, and any admin who gets a clue at the outsourcer leaves and gets a real job as soon as they can.
You'll end up dealing with muppets who either don't care, have no clue, or both.
Ob. comment that will label me a racist (Score:3, Insightful)
It's kinda funny, I joked about this very same idea, that the $2.00/hour outsourcers might be intentionally raping our servers for profit. Then the next day one of my support clients had that exact thing happen to him... one of his developers in India decided to create a bunch of email accounts and spam off of them. I have to admit, it makes perfect sense: he probably made more money selling spam runs for a few days, than a week of regular salary, plus he's not going to get into any immediate trouble... I'm not going to fly over there and beat the tan out of him, he just lost one smallish contract - big whoop.
It's not about "you get what you pay for", and certainly not a racially charged disconnect (at least not in my case), it's just the risk vs reward balance that's tipped against us. Globalization is a double-edged sword. White collar crime is just as big a problem in western societies, but we do it bigger and badder. As an American, if someone offered you $100 a day to sacrifice one of your clients, you'd probably tell him to blow you. In India, $100 might be equivalent to $1000 to us, maybe more. I don't know about you, but in my neighborhood if you want to make $1000 a day you either have to sell your ass, or sell gobs of crack and blow. The incentives vs risks aren't on the same scale at all.
I'm not saying we should treat all outsourcers as hostile crooks, we have plenty of those right here at home, on the payroll even. We just need to approach it sanely. If you underpay someone, they are more likely to fuck you over - that much should be common wisdom in the business world. It's the dirty side-effect of living in an entitlement culture.