Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm going to hire an IT guy to help manage my office's computers and network. We're a small shop, so he'll be the only one doing IT.

Of course, I'll interview carefully, check references, and run a background check. But you never know how things will work out.

How do I limit my company's exposure if the guy I hire turns out to be evil? How do I avoid making him the single most powerful person in the organization?

share|improve this question

closed as off topic by Iain, John Gardeniers, Ward, warren, Caleb Jun 28 '11 at 8:18

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

6  
The sure proof way is to learn IT your self. It sounds like you are having trust issues, which the job requires. Your title seems to say you want to protect your computer, but your subject seems your whole network. –  Nixphoe Jun 24 '11 at 18:54
6  
@SmallClanger: Anybody within an organization could turn to the dark side. But only the IT guy will be holding the keys to the city when he does. Access to finances, HR docs, trade secrets, email... not to mention backdoors, malware, and other nastiness. Who else has that kind of access? –  Jesse Jun 24 '11 at 19:26
22  
@Jesse: So you're saying that your accountant couldn't embezzle from you and cause you to go into bankruptcy? Your sales manager couldn't sell your client list causing so much lost revenue that you go under? Personally, if I were a rogue employee I'd much rather have access to your bank account than your computers. –  joeqwerty Jun 24 '11 at 19:35
7  
@joeqwerty: The accountant has access to financial stuff; the sales manager has access to sales stuff; the IT guy has access to everything. –  Jesse Jun 24 '11 at 22:11
3  
@TomWij if I were your IT guy and I knew you were doing IT work behind my back (backups or otherwise) on the system you charged me with managing, I would throw a fit. It costs you more, destroys any rapport you have with your employee, and will damage your company in the long run. Don't do that. –  Paul McMillan Jun 25 '11 at 0:58

16 Answers 16

up vote 107 down vote accepted

You do it the same way you protect the company from head of Sales running off with your client list, or the head of Accounting embezzling funds, or the Stock manager from running off with half the inventory, largely: Trust, but verify.

At the very least, I would require that all passwords for all Administrator accounts on systems and services under IT be kept in a password safe (either digitally like KeePass, or a literal piece of paper kept in a safe). Periodically you will need to verify that these accounts are still active and have appropriate access rights. Most experienced IT people call this the "if I'm hit by a bus" scenario, and it's part of the general idea of eliminating points of failure.

At the one business I worked at where I was the sole IT Admin, we maintained a relationship with an external IT consultant who handed this, primarily because the company had been burned in the past (by incompetence more than malice). They had remote access passwords and could, when asked, reset the essential administrator passwords. They did not have direct access to any company data, however. They could only reset passwords. Of course, since they could reset enterprise admin passwords, they could take control of the systems. Again, it became "Trust but Verify". They made sure they could access the systems. I made sure they didn't change anything without us knowing about it.

And remember: the easiest way to make sure a person doesn't burn your company is to make sure they're happy. Make sure your pay is at least at the median value. I've heard of too many situations where IT personnel have damaged a company out of spite. Treat your employees right and they'll do the same.

share|improve this answer
1  
Well said Bacon. I hadn't read your answer before posting my own saying the same thing. –  joeqwerty Jun 24 '11 at 19:31
    
This is the best answer. Get a trusted 3rd party on a contract basis. –  mfinni Jun 24 '11 at 19:51
    
On intuition, the IT guy changes things to effectively lock out the third party the day before he's fired. What then? Take the entire network offline until you can get it audited, every time you fire someone? –  Matthew Read Jun 24 '11 at 21:06
1  
-1 for: "I made sure they didn't change anything without us knowing about it." –  Kzqai Jun 24 '11 at 21:29
1  
better: have the emergency back account info stored by someone with no access to your network at all. An escrow service, an outside lawyer, the bank vault where only the partners in the business have physical access to. If you're really paranoid, that's how you do it. And of course have a dual key system in which there's always at least 2 people required to log in on the root account, both knowing half the password. –  jwenting Jun 27 '11 at 6:27

How do you keep your bookkeeper from embezzling from you? How do you keep your sales staff from taking kickbacks from your suppliers?

Non-IT people have a misguided notion that we IT people practice a black art that we wield from the line bordering good and evil and that on a whim we will resort to some nefarious machination soley for the purpose of "bringing down the pointy haired boss".

Managing an IT employee is like managing any other employee.

Stop watching movies that depict those of us who take the responsibility of our positions seriously as if we're rogue agents hell bent on world domination and/or destruction.

share|improve this answer
13  
My bookkeeper audits my sales staff. My CPA audits my bookkeeper. Who audits the IT guy? It has nothing to do with movies, it has to do with mitigating the risks of doing business. –  Jesse Jun 24 '11 at 19:44
3  
@Jesse: I hear you. There's a little bit of hyperbole in my answer but in then end you need to manage your IT staff like you do the rest of your staff. If you need someone to audit your IT staff then you need to take on that responsibility yourself or hire someone to take it on. –  joeqwerty Jun 24 '11 at 19:50
2  
sadly many outside of IT have th idea that every IT person is only out to crack into their systems and run off with the company secrets and the passwords to the bank account. They never even consider that we're just another bunch of people just like the rest of their employees, and that those others already have the means to do just that without needing to crack into anything at all because they've access to that data as part of their regular job. –  jwenting Jun 27 '11 at 6:22

Wow - really? gutsy question to ask on serverfault, don't be alarmed if some are offended by your question, though I do understand.

Ok, practical solutions; you could insist on (and frequently test) having your own administrator/root equivalent accounts on everything, randomly take one of the off-site backups home and restore it, obviously try to recruit from people you know/trust or spend a great deal of time employing them.

My strongest suggestion would be to hire two people - both reporting to you, not only will they keep each other honest but you'll have cover for when one is on vacation or sick.

share|improve this answer
1  
...I wonder how the hire can trust a non-tech person to be watching over his shoulder. This question reflects issues for any business. But the IT guy will have power to do all sorts of nefarious things. He HAS to have it in order to do his job effectively. –  Bart Silverstrim Jun 24 '11 at 19:15
2  
I kind of cringe at having accounts to everything for a non-tech user. There should be policies in place to make sure these aren't there for the non-tech to use them unless there is an actual need...i.e., the admin being fired. Not because the non-tech people feel the need to start poking around the mail server or do something not in their jurisdiction, so to speak. –  Bart Silverstrim Jun 24 '11 at 19:17
1  
A competent admin will balk at being required to provide non-technical users with admin passwords except in emergencies. People who don't know what they're doing WILL be tempted to mess around with stuff they shouldn't. Seal them and lock them in a safe. –  Paul McMillan Jun 25 '11 at 1:04
3  
Actually, I run into this a lot, small one man or two man shops that are just milking small businesses for ridiculous gobs of money for very unprofessional work. I think this is a great question. –  SpacemanSpiff Jun 26 '11 at 14:37

Keep your passwords safe, and make sure you don't share any accounts with this hire. Make new admin accounts for whoever you hire. This takes care of two objectives:

  1. Ensures that you don't get locked out of your network/systems
  2. Gives you something of an audit-trail, in the event something bad does happen

There isn't much you can do to limit what someone is going to do, until its already too late... Your best bet is to take on a very involved (don't micro-manage, just be involved) role until you have a high trust level with your new hire.

share|improve this answer
2  
I agree. It's tough. I'd also try to get copies of backup data (and check there's really data backed up there). You can spin it as something to do with off-site storage. Or just be blatant and say it's for "risk management". I'd also suggest you provide a notebook that is clearly the property of the company and require that he put important passwords and notes in there. Physical notebooks have a way of not failing in the same ways. –  Doc Jun 24 '11 at 18:56
2  
+1 Be Involved. The IT Guy should understand your position and fully accept that he wont be really "trusted" for a while. If he doesn't, time to find a new one. –  Chris S Jun 24 '11 at 18:57
    
He's an IT admin, and so needs admin level access. You can give him a new account, but he can just set a new password on the old ones. –  Joel Coel Jun 26 '11 at 14:20
    
@Joel -- Thats true. But hopefully you will know right away if your account has had its password changed. –  Nate Jun 27 '11 at 14:47

Do you have an HR person? Or an accountant? How do you keep your HR person from being evil and selling everyone's personal information? How do you keep your accountant or finance people from stealing everything the company owns out from underneath you?

For all positions, you should have procedures in place limiting how much damage a person can do. Your default position should be that you trust the people you hire (if you don't trust them, don't hire them or don't keep them), but it's reasonable to have checks and balances.

Even for a small company, you shouldn't have just one "IT person" who is the only one who knows anything. (the same as you shouldn't have just one person who can deal with payroll - what if that person gets sick?). Someone else needs passwords, needs to check the backups, etc.

One thing you can do is to make documentation a priority. Make sure you give the person you hire time to document how things are set up and discuss documentation when you interview candidates - ask what they've done in the past to document their network, ask to see a sample.

It's my habit to always put together a "Systems Guide" that more or less documents everything - what equipment we've got, how it's set up, procedures we follow, etc. etc. It's obviously a constantly-evolving document (series of documents and files in most cases), but at any time you can take a copy and get an idea of how the IT guy has set things up and what critical information someone else needs to know in case the IT guy is hit by a bus. If you really want to be prepared, you could get an outside consultant to go through the systems manual and tell you what they'd need to step in if anything happened to the IT guy.

Or, if you're really paranoid, you could get the outside consultant to come in and compare what's in the systems manual with what they see if they look at your systems. Is there other software installed? Are there extra admin or remote access accounts?

share|improve this answer

It's hard, since failure brings pain ( How do you search for backdoors from the previous IT person? ). If you're small enough that you don't already have an IT presence, the sort of compartmentalized structures that can limit exposure is really, really hard to put into place. Unless you have someone else to do all the high trust activities like things requiring Domain Admin credentials, you'll have to give it to your new hire.

You're hiring someone who will have high trust placed upon them so you need to trust them in return, so if you're not 100% certain, don't hire them. Background checks can help. Insist on personal recommendations of character not just competence; if they have a LinkedIn profile, ask some of their contacts or insist on contacting them.

Yes, this will be very intrusive. If you really have doubts about someone, then it is entirely worth it due to the cost to the business in case the worst does happen. When they start, work with them very closely. Get to know them. Let the entire company interact with them. Watch how they work with people.

Once the new-job glow has worn off, watch how they handle unexpected setbacks. Do they get resentful and surly, or do they shrug it off and deal? If your office is the type to do casual hazing of new people, see how they react; subtle and quiet with much embarrassment on the revenge-target, overt and flashy, or laughter and shrugging it off? These are some of the clues that can help identify a potential revenge-saboteur.

share|improve this answer
1  
A surly admin? Surely you jest! –  Bart Silverstrim Jun 24 '11 at 19:18

This reminds me of one of my first job offers I got. I was going to be the PC-guru for this job. I learned that I was going to be the only and single administrator during the job interview. I asked who should run all things when I were on vacation...

After some weeks I got a negative answer (the only one at that time). I was young and curious so I did ask why they rejected me (not that I wanted the job in these circumstances).

The answer they gave me might help you as well: "We reconsidered what you said. So instead of hiring a single IT professional we outsourced this job." I think this might be a good solution for small/medium sized companies.

share|improve this answer
2  
For many small companies, I do think this is the best approach. I worked for a Managed Services company; when it's done right it's fantastic value (not meaning cheap or necessarily expensive; just good value per dollar.) –  mfinni Jun 24 '11 at 20:40
3  
Dang, you missed an opportunity to bill them for consulting services... :) –  Cyclops Jun 24 '11 at 21:44

Read the posted answers, follow the recommendations, but no matter what you do, he'll know systems and networks better than you do. Therefore, the short answer to your question is simply "you can't". And you'll just have to live with it.

share|improve this answer

Documentation, Documentation, Documentation.

share|improve this answer
1  
Definitely. Also, someone needs to verify/audit the documentation to know it is currently accurate and works. –  Zan Lynx Jun 24 '11 at 23:47
    
Dont make it sound like punishment though, can you bring in a junior to work "with" him on the docs, blame ISO documentation or something? –  Stuart Jun 25 '11 at 4:19

in short, there's no way to guarantee that the person who has the keys to the kingdowm won't burn the place down.

  1. hire a trustworthy person
  2. treat them well
  3. treat them as a member of the company
  4. expect them to perform-reward when they do, punish when they don't
  5. for the love of all that's holy, keep authority and responsibility tied very tightly together; i.e., if this person is going to be paged at 3:30 in the morning for a system, they and only they should be the one making changes to that system. I've been on-call 24/7/365 for over ten years (I was the only network person for two datacenters for over eight of those years), and part of the reason it's acceptable is that me (and now my group) have what is effectively the ultimate authority over our systems. Others have access, but would never make a change without consulting us first. This is the single most important thing I can think of to pass on.

If you expect it to be a confrontational relationship, it very likely will be. If, instead, you treat them as a respected member of the group, then it is much more likely to result in that being exactly what they become.

share|improve this answer

The principles are very well understood, and as @Bacon says, the summary is 'trust but verify'. Some specifics, though, that all organisations should have in place.

  • No IT person should have access to everything (I know, in a really small shop it might be needed, but even there, log everything and syslog somewhere they don't have access to - it isn't foolproof but does help).

  • IT, same as other functions, should only have access to do what they need to do for their role! This may mean that certain accesses are blocked off under a 'break glass' account which requires the Director/CIO/Head of Risk/whatever to provide a password before it can be accessed.

  • Forced rotation or sharing of roles can also help to keep people honest.

  • Vetting. Background, criminal and credit checks are exceedingly valuable:

A talk I hosted by a Specialist Fraud unit pointed out that higher value attacks were often carried out by individuals with no prior record who had happened to get themselves into debt and saw an opportunity they thought would not be spotted.

share|improve this answer

I agree with much in the other comments about passwords, pay scales and stuff, but you might want to consider this:

I'm an IT guy, but I'm one that also enjoys communicating, and ensuring that what I communicate can be understood by people who aren't IT specialists.

So, we do exist. You might want to find one with similar characteristics - and make your concerns, and their allaying, part of the job description and interview process.

The right guy or gal for the job will completely understand your concerns, will have encountered some examples of the sort of person you fear, and will want to be nothing like them at all - and be prepared to work at ensuring that you have confidence in them for the right reasons.

share|improve this answer

I will not repeat what others have already said well with respect to the "Trust, but verify" principle. I'll just add that in my experience it is better to mostly trust in day-to-day operations, perhaps with a periodic audit by an external consultant. This allows the IT guy to just do his job and not feel like a suspect all the time. But you should verify backups frequently and thoroughly, including the ability to restore. You may need to learn how to do that or contract somebody to do it for you.

Besides, you need to manage this risk like any other risks: planning ahead. You should think about which threats are more important to you. Are you worried the IT guy could corrupt your data? Then you should have very good backups and use them to do integrity checks on new data. Do you think he could elope with your system's administration password so that it cannot be recovered? There's almost always a way to avoid this, but the process depends on each particular technology (look it up). Do you think he could steal your data? Yes, he could because the would be the one and only administrator. You should plan your business around this risk (e.g., lawyer up, restructure your business into separate units where each hold a key to the whole thing, etc).

share|improve this answer

A lot of good points here. From my experience, I would say:

  1. Documentation is key!
  2. Create a new Admin account for the new employee to use.
  3. Have trust in your IT professional. We are here to help, it is our passion.
  4. Hold regular meetings with your IT person. You want to make sure you two are on the same page as far as goals/progress go. Also bring up disaster recovery scenarios, etc...

I can't speak for everyone, but for myself, the last thing I want is to be the reason a business runs into problems, or worse, fails.

I have learned over the years that documentation in this line of work is very very very important. Make sure to have both electronic and paper documentation for main passwords along with important information on the way your infrastructure is configured. You should be able to pass that info onto any IT professional and they should be able to figure your configuration out quickly to help resolve any issues you might be having.

share|improve this answer

admittedly, I have not read all of the responses here, so this may have been mentioned already, but I would add: communicate well and frequently with your IT guy/girl. This will keep him in your loop and you in his. It may remind him that you are the boss. You will get to know him and may learn when something doesnt feel right. So I would say, communicate well, keep up the relationship. Meet once a week or twice a month or whatever.

share|improve this answer

This may be a wild idea, but you could agree on a special reward fund that builds up over time and will be given to your IT guy when he leaves the job. Say that you want a long relationship and have something material to support it. This will both stimulate his long-term relationship with your business, and provide an incentive to leave your company in a correct way.

Upon his leave and before giving the reward you would surely have to make an audit, so in the end you can't avoid regular checks as stated in other answers, but having some extra incentive probably wouldn't hurt.

share|improve this answer
    
A reward for leaving? Strange Idea. But there have been similar posts that say - if you have to fire an IT-admin do it fast and give him/her money (no downvote by me for your answer!). –  Nils Jul 5 '11 at 20:33

protected by Chris S Jun 26 '11 at 18:17

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.