At the end of contracting work (IT/Programming), what steps need to be taken to protect myself from any technical issues company might have

Question

In particular, I'm interested to know what to do in terms on handing over things like passwords to systems. Should I demand passwords to be changed immediately so that I don't have access?

The situation is that people taking over my work aren't well qualified, it could be easy to blame an ex-contractor for any problems, while trying to save their own job. I'm trying to protect myself from potential blame being assigned to me, if things go wrong with systems/networking/websites etc.

I have documented as much as I thought was necessary/requested. I have also got in writing confirmation that my contract is ending on certain date.

Just to add also, the fact that, like contractors, I am waiting for my invoice to be paid for quite a while after completing work. So getting blamed at this stage, while waiting, could result in at worst needing to clean the mess for free, at best being paid to clean the mess.

Answer 1

If you did everything properly you are covered already. You should have solid documentation of all progress and resolutions. You should have documentation on all testing. And you should have the actual clients endorsement that the project is completed satisfactorily.

Documentation on the work done, should be a priority, I start doing this before I even start the work. Then I keep the client informed periodically with reports until everything is finished. Once the job is completed and signed off on, you charge for any support. Personally if an issue comes up that I deem is my fault (not their staffs opinion) I fix it for free, but that's all.

With passwords, repositories etc,. you don't demand anything. You give them all to the client, with the suggestion that they are changed, outlining that it is a security issue.

Answer 2

I think bring it up would cause more problems than it would solve. That is clearly their responsibility. I would highly recommend you not log in to fix anything even the most minor if you are not under contract. I know it sounds harsh but if you help them at all they will just continue to ask for help until you have to cut them off and they will be more mad than if you just cut them off at the first question.

Answer 3

One tactic not already mentioned is to define expectations for the post-project work up front, either in the contract itself, or in a separate document.

Terms I've used in the past include a post-contract warranty period, where for X number of days or weeks I will fix for free anything that I consider my own defect.

After the post-contract warranty period, all changes require my standard rate, even if it's a defect.

This provides incentive to your employer to look for defects during the warranty period. Obviously you can still provide fixes for free if you want, but this provides protection against an employer coming back 6 months later and insisting on free work.

The important point here is to come to agreement on these expectations prior to the start of work, so there are no surprises on either side.

Answer 4

Password changes: You had months of time to cause all kinds of damage with your password and you didn't. You are leaving because your contract ended just in the normal manner, so nobody would expect that you would start causing damage now. You should (during the time they pay you) probably create a list of all your company passwords and hand it over to them; they can then decide whether to delete all accounts immediately, take their time to delete them, at least until they verified that they can access everything, or maybe even leave them for a short time in case they pay you for another week to fix some small problems.

What would be absolutely awful: If you delete your passwords, and it turns out that you were the only one with access to something.

It is usually logged who connects to some server, and where from. If someone messed up, that wouldn't be done from your account. If someone says "I'm stupid and probably mess up, so I use joshuaty's account and blame him if it goes wrong", well, that's an attitude that may put the person into jail in the worst case, and at least open them up to a libel case.

PS. People have passwords related to the company they are working for that are not controlled by the company but by a third party. For example if a company product uses a third party service, then someone must have registered an account with a password for that third party service. That kind of password cannot just be changed by the company.

Answer 5

Should I demand passwords to be changed immediately so that I don't have access?

It should not be necessary for you to do so, if your company is mindful of security and operating under best practices. Your company should realize a terminated employee with active access is a security risk to the organization. While you may not have malicious intent, there still exists the possibility of you doing harm, such as stealing confidential data, or sabotage through logic bombs / backdoors.

In all of the places I worked, as an information technology auditor / Sec. professional, there is a well defined termination process whereby departing employees have their access credentials revoked, whether automatically (the ideal method) or manually through a ticketing system.

The company is also taking on unnecessary risk, as a disgruntled former employee can hack into the system if access is still active past their employment, through remote means if he has equipment such a company phone / tablet / laptop.

Answer 6

The smart way to handle this is to create a book of the project and code you worked on. Print out flowcharts, code, a change log, and any user guides and documentation and present it to your bosses before leaving. Code can be changed, print cannot.

Beyond that, it is almost a cliché that the contractor gets blamed for the troubles the current employee is working on. CYA, but expect blame anyway