The contractor’s laptop
A contractor’s personal laptop was infected, and private repositories were copied.
(Illustrative scenario, not a real incident)
At this thirty-person software company,every laptop had antivirus,disk encryption, and device management.IT felt the hardware was covered.
But company laptops weren’t the only thingslogging into company systems every day.
The company had long worked with three contracting teams.The contractors used their own computersto log into the code platform and the cloud console.
One day, a contract engineer’s computer was infected.His login session was hijacked,and the attacker copied several private repositories.
Only afterward did the company realizeit had no idea at allwhat state its contractors’ computers were in.
For convenience, contractors hadthe same access as full-time staff.The contract said nothing about device requirements,nor about reporting incidents.The projects ended; the accounts remained.
I used to think trusting a partnermeant not interfering too much.Later I learnedreal trustmeans setting the rules out clearly first.
Say the hard things up front,and a partnership lasts longer.
- Give contractors only the projects they work on, with an expiry date.
- Write device requirements and incident reporting into the contract.
- Revoke accounts the day a project ends.