Use of contract worker

We have recently hired a contract worker to assist on a project and I am trying to advise HR and upper management on using a contract to outline an AUP for when said contractor accesses the internet....and also have him document his work.

I am hoping for some has a links to some basic guidelines to follow showing how important it is to have a contract and documentation of the work done....and the risks of not having these in place.

Any links and or suggestions are greatly appreciated as always!

MLF

Hey MLF Start here http://www.sans.org/reading_room/whi...nsibility-it_3

Now since I know a bit about your contractor, I have a nice little bit of malware I could send you. It will do all the nasty things slammer and code red did, but it will not replicate or spread. I use it every now and again when my lusers don't follow the "don't allow vendors or contractors to connect to the network with out contacting IT first" Rule.

Thanks Dino...yes same contractor.

I did find the constant DNS requests were his iphone piggybacking on his laptop to get mail as Hybr|d suggested....but I still receive excessive UDP requests which I attribute to P2P. When I blocked the program on the local router in use (segmented from our corporate network)...the little ba$tard reset it...and then "could not" remember the admin password he set.

I again reset the router.....and approached upper management. They have no contract....no documentation. A project that was to take 1-2 weeks is now in its 3rd month...and the little twerp is playing P2P network games while here. <shaking head>

Of course...now the little ba$tard knows I am on to him.

<sigh> .......all I can say is...its typical from our upper management :rolleyes:

MLF

Why does the contractor have access to the Router?

The contractor has physical access to the router because he and the R and D products are on a segmented lan ....outside of our corporate network...but sharing our internet. Together we set up the router ...which he needed access to for the setup of the devices in development...using both wifi and wired.

Once the initial setup and functionality was done...I reset the admin password and set it to filter the P2P traffic....he hard reset it...and would not give me the password

He has physical access to it because he told management he needed access to set it up.....

I am trying to make them see that he does not need access to it for the project....

I reset and set a password that I did not share with contractor....the UDP traffic has since stopped.....with no loss of functionality to our R and D devices.

Because there is no contract or AUP...he can pretty well reset if he likes.....unless I can show management reasons and risks of letting him do so.

Hence my initial request

MLF

Quote:

---

he hard reset it...and would not give me the password

---

"pick a window, you are going out" :lildevil:

I guess I would cut off his internet share.................if they want to do their own thing then let them?................... but they have to make their own arrangements.

Back in the day I would give a contractor a telephone socket and let them get on with it............OK that was pre-broadband. Nowadays I would be tempted to set up a standalone home broadband account to achieve the same (make sure that it is the slowest and crappest you can find)............as a corporate you might have to go for the type of account that pubs, restaurants and cafes use...............over here those are pretty basic.

What the hell kind of organisation employs a contractor without a contract, terms of reference etc.???? I mean contractor..................................?

I don't know Canadian law, but over here if someone set a password on your system (which they have no legitimate reason to do) and then refused to reveal it, they would be looking at "the big house" for sure.

Does your company have a legal department? they might be interested?

Quote:

---

What the hell kind of organization employs a contractor without a contract, terms of reference etc.

---

Not a very smart one !!!! (Private family owned.)

I am not happy with the whole thing.....all I can say it is typical for our HR ditz and her consort :rolleyes:

Its a long sordid story and you really dont want all the gory details :eek:

I need to show the risks of

1. not having a contract with the AUP
2. lack of documentation of work\programming

I have found some good stuff on TechRepublic since my original posting....and will present next week....its all I can do...and to continue to monitor and document.

MLF

Well, if you don't have a contract how do you define what the deliverables are? Also, remuneration rates, allowable expenses and all that.......... lawyers can be very expensive:eek:

A system that is not properly documented is difficult if not impossible to support.........also to update. Are you expected to support it after it goes live?

Supposing this guy gets killed in a car crash or whatever (I will give you an alibi MLF:lildevil:) what then? You will fetch up paying a fortune for someone to analyse the system to find out what it does and how it works?

Otherwise you are faced with a complete re-write?

The basic reasons for contracts and documentation are to avoid downstream costs. They are pre-emptive rather than pedantic.

Quote:

---

Supposing this guy gets killed in a car crash or whatever

---

falls out a window :lildevil:

I know all that....they dont :rolleyes:

MLF

I already mentioned the window (defenestration is the technical term I believe) :cool:

Hey, you have my sincere sympathies MLF, it is not a nice position to be in. I don't want to worry you further but to me this guy does not sound very professional; I am willing to bet that if a more lucrative contract came along, he would drop you like a hot brick.

After all, he doesn't have a contract. Also, without documentation, how could anyone pick up the pieces? You would probably have to start from scratch, which means extra cost and delay. I know that specific performance is hard to enforce in these situations, but once the word got out that he breached a contract he would pretty soon find himself unemployable because no-one would trust him.

I for one would certainly not employ someone who was prepared to breach their existing contract.

Supposing he contracted a long term illness (nothing trivial I hope:lildevil:) .....would the company be prepared to wait? Without documentation they wouldn't have much choice would they?

I know I am preaching to the converted, but the company doesn't seem to understand the professional aspects of systems development and employing outsiders?

I have been trying to suggest a few arguments you might use, but at the end of the day I would suggest that emphasis on cost risks might get a better understanding. I bet they understand money, if nothing else? :D

oh yes they will understand the money part..

This project was beyond me...so I suggested contacting the local college and seeing if they had someone that would be good for the project...

Enter cocky young contractor....I know everything attitude.....

Personally I doubt he would last long in a corporate environment...he has no personal skills...blames everyone and everything else for failure....and underestimates his co workers :D

Yes he did a good job writting the requested interface.....but lacks the other skills that will keep him his job....when questioned about the additional network traffic...he sloughed it off..... maybe our devices have a bug and his attitude and disregard for our concerns tweaked my spidy sense ...so i stated to look further into it.

The other people working with him directly have also voiced complaints on his attitude as I suggested using him on another project which is delayed where he could write a similar application......

So we have a cocky kid...close to finished said project coming in and playing network games, using P2P software and extending his time here doing nothing....

and as far as I know without a contract, AUP or documentation.

I come from a corporate environment....and have worked for local governments......I now live in a small town and work for a family business.....

I am now going home to :drink:.....and dream of the day the kids are done school and I can leave this fookin place :D

MLF

Quote:

---

and as far as I know without a contract, AUP or documentation.

---

Well, no contract = no obligation to pay?

"Now look son, we are now in what we professionals call the 'retention period' you get no further progress payments until the job is completed and the documentation is on my desk, then we pay you the 'retention amount' or residual balance "

BTW, you have been declaring this income to the revenue haven't you?:lildevil:

Last I heard from my lot was an envelope with a compliments slip and a Customs and Revenue mouse mat..................:)

Quote:

---

blames everyone and everything else for failure

---

Reminds me of when a managing director asked me who was responsible for a particular balls-up........... I said "me".............. he said " it couldn't have been you were on holiday in Spain" ............ he had already asked my boss who had claimed responsibility himself although he was in America at the time.

I pointed out that we were the two senior IT managers and if we left the shop in the hands of someone who couldn't handle it then it was our responsibility. That went down extremely well as it happened. I am afraid that I do not like blame cultures, as I consider them totally counter-productive.

Quote:

---

I come from a corporate environment....and have worked for local governments......I now live in a small town and work for a family business.....

---

Similar story.............34 years in London and thereabouts with corporates, central government and WMD; now in a seaside town of 32,000. I work for myself now, mostly supporting small businesses and installing turnkey systems, although I do get some local government work (political connections;)) and private repair, upgrade and build requests. The beauty of it is I have no competitors for 17 miles (well, they won't find the bodies anyways:xbones:)

:drink:moi aussi

Quote:

---

Originally Posted by morganlefay

I am now going home to :drink:.....and dream of the day the kids are done school and I can leave this fookin place :D

MLF

---

MLF I have no idea how hard it is for you to get a job in the U.S. When we shut down our Toronto Facility we brought over two Canadians and there didn't seem to be any problems.

So when the girls get out of school, call me - I'll hire you in an instant.

Nihil....the powers that be dont see it that way...they just want the new product out no matter what...and are notorious for not getting the proper documentation in place. This isnt the first time....I am only trying to cover their asses...because I am the one that usually has to clean up the mess.



Thanks Dino...you flatter me.

I am definitely reaching burnout point....more frustration with the current environment I work in......

Will keep that in mind ;)

MLF

It's not flattery, consider it more of begging. Really. The last two times I tried to hire a network administrator, either the resumes had LOL typed in somewhere or the applicants couldn't explain sub-netting.

Everyone and their brother is M$ certified and if it isn't windows server 2008 or at least have wizards, they don't know how to use it.

On applicant explained to me that there was no need for a CISCO firewall because windows server had a firewall built in.

The worst part is all applicants now days believe that customer service is their #1 priority.

Really? They realize there customers are end users and they sincerely believe that the customer is always right.

I fear we are raising a generation of Super Users and Bitches and Bastards like us are a dying breed.

Sorry about the RANT, The server room on the North end of the building got to 100 degrees early Sunday morning and I've been dealing with that.

Quote:

---

The worst part is all applicants now days believe that customer service is their #1 priority.

---

So do I, and so do you! the main difference is that you and I would only consider it to be such if it were part of an existing Service Level Agreement (SLA);) After all, it is by providing customer service (in its broadest sense) that we earn our money; but we do need to have rules of engagement?

I come from a development and project management background, and insist on terms of reference, a user requirements specification and a project plan. All of which have to be signed off by senior user management. If you don't insist on that you are wide open to what we call "scope creep" :eek:

Quote:

---

They realize there customers are end users and they sincerely believe that the customer is always right.

---

But they don't realise that the degree of customer correctness is directly proportionate to the number of used twenties ($20) in the "brown envelope"? :lildevil:

Quote:

---

and Bitches and Bastards like us are a dying breed.

---

Hey Dino, can't you spell "professional" because that is what it really boils down to.

:)