7

I am senior lead / team lead in the cybersecurity division of my employer located in the United States.

I recently hired a contractor to work on pen testing (highly privileged role having access to vulnerabilities). Recently, my team was tipped off by an employee that this contractor may be under a fake identity and of a nationality barred by OFAC sanctioned listings. Think of Belarus, N.Korea etc.

As the person came to us from a intermediary temp agency, we did not do the background check and simply relied on the clean results of such from the 3rd party background checking firm communicated to us from the temp agency. This company did background screenings for us before with no issues on the contractors cleared, so as the hiring manager, I had a reasonable belief the results this time were again legitimate.

I plan on talking to HR and corporate counsel to see what can be done / how to mitigate risk such as disclosure of vulnerabilities etc.

What else can be done to mitigate risk to the company?

Not saying the background screening firm acted in bad faith, but would further due diligence be worthwhile on them?

What steps can be taken to mitigate tipping off this contractor, such that they may retaliate with further damage to company?

6
  • 2
    Have you contacted law enforcement? Might be good to let them intervene and do a search to see if this contractor is really a fraud.
    – Slaknation
    May 11, 2022 at 1:10
  • With what evidence was the tip off made?
    – Kilisi
    May 11, 2022 at 1:14
  • @Kilisi, Apparently they were putting up an act, and the tipster overheard a conversation outside of the office area where my team is located.
    – Anthony
    May 11, 2022 at 1:21
  • 4
    Keep in mind that whoever tipped you may not always know the true state of affairs. What if the pen tester was a refugee from a banned country who later got citizenship in elsewhere and legitimately got the job? His Facebook profile may seem like he has studied and worked in a banned country but that doesn't necessarily mean he is banned at the moment. A pofessional background check says that he's clean means he's clean unless there's solid evidence, not hearsay from someone casually looking at his internet history.
    – androidguy
    May 11, 2022 at 9:31
  • if the "tipster overheard a conversation" is true, would your reaction be different if the pen tester was a citizen of your own country?
    – androidguy
    May 11, 2022 at 9:38

4 Answers 4

6
+50

Often, a professional environment teaches us to be more concerned with appearance and offending each other than we really should be. This issue isn't about who's eating someone else's lunch out of the shared refrigerator. If your workplace has to care about the O.F.A.C. then someone's been accused of a federal crime. This an extremely serious situation where the contractor may need to be investigated by law enforcement. Full stop. They will have the resources to address this appropriately. You need to be the adult in the room. If the tipster is wrong then they will need to apologize, and if either party has lied then you should fire the liar. Were I dealing with this myself, my short answer is that I'd require the "tipster" to speak to law enforcement. If the tipster wasn't willing to do that then I would explain to the tipster that they have alleged a felony has taken place, and avoiding a police interview really isn't up to them.

You also asked: What else can be done to mitigate risk to the company? What steps can be taken to mitigate tipping off this contractor, such that they may retaliate with further damage to company?

While your mental alarm bells are going off the fact is that any damage has already been done. Either the info you shared can be changed or not and a penetration tester has either found vulnerabilities or they haven't, have left something behind or they haven't. If the contractor turns out to be operating illegally then they will simply not be around to retaliate after law enforcement gets involved.

A quick note about temp agencies: The term "temp agency" is not precise, and gets applied to different types of staffing. According to the industry's own statistics only about 10% of the temp placement industry is advanced technical work like engineering or penetration testing. Over half is low-level clerking work such as data entry, and about a third is janitorial, construction, or warehouse work. Their own industry's data shows an average ten week placement. This may not be the correct way to discuss your choice in staffing service. The following presumes that you're working with a service such as Robert Half, Randstad, WeWork, Allegis, etc.

So how much of a background check makes sense? The first thing to understand is that not all background checks are equal. Since any temp agency is going to want to provide a job placement so they can start collecting their fee they won't dog very deep. All a temp agency is going to do is get consent for a basic criminal background check, which they're going to run using the provided name, date of birth, and social security number. If that person really exists somewhere they're not going to know who they're really dealing with. Common practice in the industry is to run a drug test as well. Were I the one hiring from a temp agency I'd never staff for a position that had to respect O.F.A.C. Something run through a credit firm with a quick pull by S.S.N. from the F.B.I.'s database is a far cry from a full B.C.I. or anything the military would do for compartmentalized clearances. Every type of background check has a different process and a different level of scrutiny. Most background checks do not involve any in-person investigation. Figure out what level of scrutiny you really feel is appropriate going forward. Set a policy that matches.

1
  • 1
    Solid first answer, welcome to the site.
    – Kilisi
    May 17, 2022 at 13:03
14

This isn't your responsibility to handle or try to conceal or hide anything. It needs to go straight to HR or the companies designated Compliance Officer after which you comply with anything they ask. Breaching Sanctions regulations can get a company closed down, bank accounts frozen etc,. so it's well out of a team leads hands.

Usually there will be a Compliance Officer (unsure in your region) whose job is to investigate anything like this and has their own procedures and reporting to follow. I'm not in the USA, but this is standard in the 3 countries I work in compliance. At the end of the day it's their responsibility to make the call on what will happen next.

Be aware that this can go both ways, if someone is found to have made a false tip off they may well end up unemployed.

What else can be done to mitigate risk to the company?

If the company is operating under legislated or regulatory restrictions with Sanctions lists etc, there should already be someone there with the training to take control of the situation. There is little chance of the person not finding out. Usual procedure would be to immediately remove them from the job until the investigation is complete.

Realistically the 'tip off' should not have been made to a team lead in the first instance, it should have gone directly to the Compliance Officer or HR, so there is a lack of basic training involved.

Once in the Compliance Officers hands risk to the company is negligible. They just need to assess the situation and do their job. But depending on circumstances there can be time thresholds involved. My current country would expect a suspicious activity report filed with the regulatory body on the same day, others within a set period.

1
  • Bigger companies will also have a legal department (or similar); wouldn't hurt to ask that department for next steps.
    – zmike
    May 16, 2022 at 23:01
3

If you suspect that he is out to hurt you, then you close off all access that he has, and escort him off the premises. Once he is safely gone, you can then investigate and find out the truth. If you were wrong, and everything is Ok, you apologise. If they are genuine, then a penetration tester will understand that you have to be careful.

0
2

This is not something to address yourself. With no offense meant, if you do not already know exactly what to do here, then this is absolutely not something that you can deal with appropriately.

CEOs and Chairmen of Boards have resigned over their companies handling this sort of thing inappropriately (in Australia at least).

If you haven't already escalated this, then escalating it is more urgent than anything else on your plate.

I don't believe I am saying anything not already addressed by Kilisi in the top rated answer, but I want to emphasize the urgency since your reading of that answer lead to you to think

Current top rated answer seems to say this is a non problem even though I am the hiring manager. Seems a bit dismissive too.

The current top rated answer says the opposite of that. The fact that you are the hiring manager is irrelevant. Escalate this as your top priority.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .