• Lynn Pettis (12/11/2013)


    jim.drewe (12/11/2013)


    Lynn

    I normally don't follow up on these types of tracks, but I think what I was trying to say (and presumably what the other gentlemen was also trying to say) is your ***typical*** outsourcing arrangements.

    I am an ex-Marine (Vietnam era) and my son served both as an infantryman and contractor in Iraq (Ramadi, 2007-2008). I am not going say that every type of outsourcing is an audit risk. Military campaigns by nature invoke risk. After all, you are trading lives for real estate. You cannot compare IT in an active military theater with IT in New York or London. So, yes, what you are doing falls outside the scope of what type of outsourcing arrangments I am referring to.

    I haven't taken exception to any you have said, Jim. I have taken exception with the comments made by Eric regarding contractors and comparing them to Edward Snowden. I feel he has lumped us all in the same bucket with a few bad apples.

    My point is that I don't understand why a government agency or corporation would out-source a database or network administrator. Why pay a contractor $100,000+ a year to shuffle your backup tapes and network logins, when they could hire a full time staff member for half that cost?

    I'm not saying they shouldn't do it; it's just that to me the risk / reward and return on investment doesn't seem to work. Having an outsider in an operational position, handling your most sensitive data, adds risk to the equation but adds no value.

    I'm not comparing all contractors to Snowden; I've on the contracting side of IT in the past, and could potentially assume that role again in the future. But both contractors and employees both have their strong and weak points. Like I said earlier, the guys who manage your most confidential data should be kept on a short leash. If a contractor gets fired, then he can just move on to the next gig. However, if an employee gets fired, then he's screwed much harder. That power which an organization has to screw an employee who does something really stupid, like intentionally or carelessly leaking sensitive data, is just another tool that the organization can leverage to insure that they data is kept as secure as possible.

    That said, there is plenty of room for contractors in the realm of information technology.

    Hiring a contractor to architect the data warehouse or re-write the

    application and then hand it over to in-house IT staff - yes, definately.

    Hiring an expert contractor to spend a couple of weeks performance tuning the sql queries or network topology - yes, definately.

    "Do not seek to follow in the footsteps of the wise. Instead, seek what they sought." - Matsuo Basho