-7

Our organization acquired a software from a software engineer (Alice). Alice designed the software to take 2% off the top of all transactions and place it into her bank account. If we complained to our cyber security experts, Alice may cause of more harm to our organization.

What steps can we take to mitigate further third party loss, such as by Alice?

What are some suggestions for how to mitigate future occurrences?

closed as off-topic by gnat, Jim G., gazzz0x2z, IDrinkandIKnowThings, Michael Grubey Dec 7 '18 at 0:34

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – gazzz0x2z, IDrinkandIKnowThings, Michael Grubey
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You can hire another developer and try to fix the issue. – Milind Singh Dec 4 '18 at 5:44
  • I can hire another developer but the already present developer can create many issues for our organization beause she is the developer of this software and she can make much more losss to our organization – sehrish afzal Dec 4 '18 at 5:58
  • Welcome to the Workplace, @sehrishafzal. Can you tell me what type of organization you work in? Also it appears Alice is a vendor of your company? Is this correct? – Anthony Dec 4 '18 at 23:45
  • I edited your question to make (what I think is your goal) clearer. If I am wrong, please feel free to roll back to previous version – Anthony Dec 4 '18 at 23:57
  • @JoeStrazzere - great suggestions that I will incorporate into my answer that I am writing now. – Anthony Dec 5 '18 at 1:14
9

Sorry, I don’t see any reason for not to terminate the developer immediately and block all her access to works. Report to police and security experts.

6

First:

  1. Hire/pay a lawyer so he can help you for the following steps
  2. Investigate for all sensitive point she can/could have reach.
  3. Gather all the proofs for her actions.
  4. Do all the necessary backups and data duplication.
  5. Prepare yourself to get some losses (where, when, what amount, how much time to recover).
  6. Start looking to hire other developer.

Finally:

Strike with the power of law.

I know no countries where such actions couldn't lead to trial and serious consequences for the developer. Point #5 will help you asking for financial compensation.

After all:

Review all validations, tests, releases, even hiring procedures of your company.

5

I work in IT Security as an security auditor and have experience analyzing security incident response practices. First of all:

If we complained to our cyber security experts, Alice may cause of more harm to our organization.

You are missing the point. While it is true that reporting this person to your IT security team may trigger retaliation, a formal investigation needs to be done by the cybersecurity function both to stop the immediate damage and find out what other damage Alice may have done to your company. By not reporting this fraud / security incident to the proper authorities within your company, you are compounding the damage being done and not allowing security to do its job.

Mitigating retaliation by Alice

  • Revoke all access to your company for Alice

The first step at mitigating retaliation is to revoke all access to your company that Alice may have had to limit the extent of harm she can do. This step would include procedures such as deactivating badges, changing passwords she was aware of, disabling domain accounts etc. Also if Alice had remote access (such as for vendor software support purposes), also remove that functionality.

  • Review your other systems / software that Alice touched

What you have discovered may only be the tip of the iceberg. There may be other logic bombs / backdoors / malware etc. that Alice may have added to your company. Disgruntled vendors may plant malicious software into clients IT infrastructure to cause additional damage even after they are gone. If these have not been deleted / tampered with (assuming Alice is smart to hide her tracks), reviewing audit change logs would be a good first step.

  • Inform senior management and legal counsel of your company

Your company has a serious liability here. You needs to terminate Alice immediately. From your description, Alice may not be rational, so it is wise to let your company senior management and legal counsel (if available) know so they can take additional preventative steps to mitigate damage. Assuming senior management and legal counsel are reasonable and care, they should be concerned.

Preventing future ocurrences

  • Reviewing third party due diligence procedures prior to contracting

This event raises some questions as to why your company chose to purchase from Alice in the first place. What kind of due diligence was done into Alice's trustworthiness as a vendor? Who at your company authorized the relationship with Alice? From the limited information you gave, I would say strengthening vendor due diligence screening and risk management practices is a worthwhile effort. If management pushes back, point to this incident as to the consequences of lack of vendor due diligence. This reading may be useful as to what to consider when evaluating IT vendors.

  • Security testing and signoff during QA process

This malicious code was apparently missed during the QA process prior to promoting the software purchased from Alice to production. Why? Is the code QA process inadequate? Are people in the QA testing function not competent? Something else? I feel it would be beneficial to review how you are testing the code , specifically non-functional requirements, to be deployed to production and perhaps suggesting improvements to management depending on your role in the company.

Not the answer you're looking for? Browse other questions tagged or ask your own question.