92

I am a recent Bachelor's graduate in computer science - I have been employed in the field for less than a year.

My current employer is asking me to design and implement a relatively advanced information security schema, and it makes me somewhat uncomfortable. I am willing to try my best, but I have not been formally trained in security at all, and have no workplace experience in engineering security.

How can I best communicate that, "if you trust me with no qualifications to design this system, and something goes wrong, that's your fault for not hiring an actual information security expert?"

Also - is there any way that this could impact me legally? I do not want to be legally liable if I am fully aware of my inexperience and lack of qualifications.

I am a contractor, not a full-time employee.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Apr 21 '18 at 1:39
109

Honesty is the best policy here.

Thanks for giving me this assignment. You realize of course that I'm not a security expert and I'm going to have to spend time researching this, and even then it might not be a great solution?

And see where things go from there.

Depending on the need/solution, you might want to get an external consultant in to take a look over your proposal and get things tightened up before deployment.

It's doubtful that this will impact you personally if something goes wrong - your boss/others should examine/test/approve whatever you propose which ensures that any liability with lies with the company, and not with you (you're just following orders after stating your limitations, after all).

As part of due diligence, make sure that you have emails/paperwork demonstrating that the business is happy with you working on this and are aware of your lack of expertise in this area. Print the pertinent emails out - sometimes problematic emails have a habit of "disappearing" from Exchange accounts.

  • 75
    Additionally, ask for formal training as part of this project. – HLGEM Apr 16 '18 at 14:42
  • 75
    And make sure that all of this is documented formally in an email that you can point to to show that you tried to get the right things. – HLGEM Apr 16 '18 at 14:50
  • 2
    Presumably, this answer (and the comments) predate the information that the person is a contractor. I don't think this negates the underlying answer, but it does impact the details. – RDFozz Apr 16 '18 at 19:57
  • 17
    Nice answer, but two words you're missing: paper trail. – Mehrdad Apr 17 '18 at 1:43
  • 5
    I would respond slightly differently -- namely, I'd say that any solution I came up with would certainly be less secure than an adaptation of an existing solution by a security professional. It's not "might not be great", it's "I will definitely miss some security vulnerabilities because this is not my field of expertise". Security is extremely hard, and someone with no experience designing secure systems will inevitably leave something vulnerable. – Nic Hartley Apr 17 '18 at 17:50
44

As a contractor (information in the comments), you also have to be very wary of accepting this work without the knowledge and agreement of your own employer, the contracting company, as they may have some legal liability in this. If you are your own company, then turn down the work.

To explain further about turning down the work, if you are a sole person contractor, then you might have legal liability in the millions of dollars (maybe even hundreds of millions) if you accept the contract. Security breeches can cause huge amounts of damage to a company and to their clients.

The fact that you know that you are unqualified would probably make it even more likely there would be serious breech and more likely they would win a case. There is no circumstance where it is safe for you as a contractor on your own to take this contract. If you doubt me, consult a lawyer before accepting the work.

  • 1
    Turn it down? I agree with the wariness and the need for transparency but a job is a job and experience cannot be replaced when you are fresh out of college... – USER_8675309 Apr 17 '18 at 3:55
  • 9
    @USER_8675309 Sure, but you don't want to be the next "Six Million Dollar Man." If you're on your own, as in contracting directly to the company, I would turn this down just to make sure I'm not the one on the hook when(not if) the security system is breached. – Booga Roo Apr 17 '18 at 3:59
  • 10
    @USER_8675309: If you don't have professional indemnity insurance, get some, now. Ensure that your policy covers the potential liability. Ensure your contract with the company limits your liability to that which your policy covers. I am not a lawyer. :-) – T.J. Crowder Apr 17 '18 at 12:07
  • 3
    @USER_8675309 " but a job is a job and experience cannot be replaced when you are fresh out of college... " Experience is invaluable. Such as the experience to not do risky things one is not qualified to do. One can decide to learn this the easy way or the hard way - the lesson is the same. – NPSF3000 Apr 18 '18 at 15:06
  • 3
    Yes. The proper ways to get experience in something like this is to be PART of a project under the guidance of someone experienced, NOT being the only contractor and legally obliged to deliver. – TomTom Apr 19 '18 at 12:19
20

Any answer you get is based on an assumption:

  1. You're a contractor who's actually a misclassified employee. (Very common in the USA.)
  2. You're a contractor who's really a contractor.
  3. Agency contracts with Client ('current employer'), but you're an employee of Agency.
  4. You're actually an employee of 'current employer'.

If the assumption is wrong, then the answer is probably wrong too.

If you're operating as a "true" contractor, then you should consider yourself as a vendor and act accordingly (see Adam Davis' answer.)

In any event, it is smart to be worried about the stuff that you're worried about, but it sounds like you'd benefit from some professional legal advice. Anybody can answer on the internet, including Law.SE, and those who do are not responsible for their advice. A professional will review your situation, challenge the assumptions, and they'll be liable for their advice.

If I were to advise someone in your shoes, I'd be highly suspicious about whether they're misclassified employees, because that makes a huge difference in the analysis, the potential consequences, and the avenues for redress (and, most importanty, who's to blame).

Many attorneys offer free initial consultations, and you might get some good guidance out of it, steering you down a different path than you imagined.

16

There are probably entire books on this subject and it's impossible for anyone to give you a definite yes or no answer. However the cases where employees have been found liable are extremely rare.

You are acting as an agent of your company and are generally assumed to be acting in good faith. Your boss knows your experience and has directed you to complete a task that is lawful. So as long as you don't intentionally screw it up, or intentionally implant malware or lie to your boss about what you've been doing, you're almost certainly going to be fine.

If you're really worried, be sure to document your processes carefully and ask to have your work reviewed by someone more senior (this is a good idea anyways).

  • 3
    This only applies to actual employees of a company, not independent contractors. – xxbbcc Apr 18 '18 at 14:07
11

As a contractor you are at increased risk and liability than if you were an employee.

Consider purchasing Errors and Omissions insurance, which will provide you with some protection, but be aware that even that may not cover you if you're working outside your proven area of expertise. If another expert can sit on a witness stand and point out a dozen things you did incorrectly, you may still be liable for any resulting damages.

Also, consider starting an LLC, which should further insulate your work from your personal finances, so even if you are determined to be responsible for damages, you may better protect your personal finances.

As a contractor you are responsible for understanding your area of expertise, and providing work product that meets minimum professional, expert standards.

If you feel uncomfortable with this you can either take classes or instruct yourself until you believe you can do the work to a high standard, or you can insist on oversight - essentially several meetings with a security consultant who provides the needed sign-off on the design and plan, or at least prevents you from making the simplest mistakes. If you can't do either of the above, consider bowing out of the project.

  • 1
    The LLC may not hold. If you take up work for which you are not qualified this is fraud, i.e. criminal. Nothing breaches a corporate veil faster than criminal behavior. – TomTom Apr 19 '18 at 12:20
  • @TomTom Correct, which is why I used the weasel words "should" and "better" in that paragraph. Neither insurance, nor LLC will protect you from criminal activity, and both only provide some limited protection from civil lawsuits. A well funded lawsuit will still be able to pierce through both and affect one's personal finances, even in the case where you're not at fault as they can simply wear you out with lawsuits. Nevertheless, insurance and an LLC can provide better protection than nothing, and for the majority of these situations they are adequate. – Adam Davis Apr 19 '18 at 15:05
7

As a contractor you live or die on your contract -- you should have some boilerplate written up by a real lawyer that indemnifies you against liability for consequential damages, and if you will be doing a lot of this probably an LLC to limit your personal liability.

That aside, I would differ from the other answers in that the fact that you have been hired to do the job indicates that the employer feels that your qualifications are sufficient.

Whenever you start a new contract there is likely to be some research and learning to be done -- if you are diligent in this there is no reason for you to share your self-doubt with the employer. Just work to remedy any gaps in your knowledge, then do the work to the best of your abilities.

tl;dr: Make sure you are protected from liability, bite off as much as you can chew, and chew like hell! :)

  • +1 Indemnity is exactly the question he needs to make sure is explicitly addressed. – Ben Hocking Apr 17 '18 at 2:05
6

In addition to the other fine answers, I would suggest hiring a third-party infosec auditor familiar with this type of development to validate your application/plan. In a few hours of time you can share your requirements, plan and get their feedback/suggestions which will definitely help bulletproof your development. Also, if there are any ISO standards for this time of work, you should definitely set out to maintain compliance in your applications.

  • 2
    This is a good idea but it can be hard to find infosec expertise in development. Most of the field has been dominated with network security. Also, this is really something that the employer would need to do so the OP can only really recommend it. – JimmyJames Apr 16 '18 at 15:08
  • I fully agree with this idea: you can explain that this kind of work needs a higher price than what you usually do, and use the extra money to bring a good security person onboard! – JoaoBotelho Apr 18 '18 at 9:35
  • @jimmyJames I work in infosec and I see auditors specialize in much more than network security. Specialities can vary from identity and access management to cloud security to DLP. where are you getting this information from? – Anthony Sep 9 '18 at 15:05
6

As a contractor you must have personal indemnity insurance. Depending on which country you live in this may be a requirement by law. I worked as a contractor in the UK and this was a requirement before starting work. If you do not have it already, get insurance!

Professional indemnity insurance is designed for professionals who provide advice or services to their customers. It protects your business against legal costs and claims by third parties for damages arising from acts, omissions or breaches of professional duty in the course of your business.

It is inexpensive and it means that if you make a mistake that results in a security breach and/or cause damage to the company, your insurance will cover you up to millions of pounds/dollars.

Equally if you feel uncomfortable doing this work, it is your right as a contractor to turn it down. You may lose the contract. Perhaps discuss your concerns with your employer, ask if they can afford to send you on a training course before you begin the work.

  • 3
    Try getting Insurance covering financial damages when you work on IT-Sec products. Will probably have to double your rates to pay for it! – Daniel Apr 18 '18 at 9:13
  • @Daniel haha yeah no doubt it costs a lot more than getting covered for front end dev :D – Pixelomo Apr 19 '18 at 1:13
  • 1
    Actually it does - particularly if your answers to all the experience questions are "I have never done this before and have no formal qualification". – TomTom Apr 19 '18 at 12:21
3

I would handle both aspects of this, in the same way. I would do this by email (puts it in writing, removes deniability and any claim that you his anything...)

"As you know, I am not security qualified, and security needs to be done properly. While I would do my best, I need to emphasise that in my view, I am not the right person to do this specific task, as it needs very specific qualifications and/or proven experiences. Frankly I think Im the wrong person for this. Please reconsider carefully if I am the person you want to task with this. That said, as you know I try to do all I can, so if you do want me to do this, despite my concerns, please could you explain how exactly you want me to go about it, given my inexperience."

If you want to."lay it on thick", end the last sentence with: "... so the client still gets the high standard expected , and is not at risk of being affected due to the above."

Not only does this make clear you are being professionally concerned and amicable to any reasonable solution/direction, it also puts it in writing, which means its a lot harder to pretend they didn't know, or ignore it. Having it in writing can be a good, if innocuous, motive to a company, to reconsider a possibly damaging decision and ask themselves "what if it comes back to bite us"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.