Question

You are a member of the management team at goliath financial. Recently, a staff programmer, Eric dynamic, applied for a more senior position with the compnay but the position was given to someone else. Mr.Dynamic immediately gave his two week notice. The day after he left the company, a programmer error caused several master files to be erased. You discovered that eric dynamic had left a programming time bomb that was responsible for the damage.

Please question the below scenario based:

What should you immediately do?

Should you legally pursue the ex-employee or is it better not to publicize this?

HOw can be sure there not additional time bombs waiting to go off?

How did this happen?

What is your policy for change control ( Software installs)?

What needs to be modified or changed?

What should be your long-term strategy for departing staff?

What should be your general policy on employees who are leaving?

should you have the same policy for both technical and non-technical staff?
shoul technical staff be allowed to stay with the company after giving notice?
should departing staff be allowed to make software installs?

New policy:

Based on completion above questions, write a new policy that covers employees leaving the company and change control. Include any special conditions that need to be apply for technical employees, Also provide you recommnedations for dealing with this particular programmer.

Answer 1

Your feedback is highly appreciated!

What should you do immediately?

The first course of action should be to try to recover the erased files from backups, version control systems, etc.

A financial company must have several security programmes in place.

Should you legally pursue the ex-employee or is it better not to publicize this?

The employe should be pursued legally. Mr. Dynamic erased files that could have been critical to the company and might have put other peoples money at stake as Goliath Financials is a financial company.

Causing so much havoc at a company proves that Mr. Dynamic can't be trusted and shouldn't be allowed to work elsewhere.  

How can be sure they're not additional time bombs waiting to go off?

Version control systems like git could come handy to check what code changes were made by Mr. Dynamic during the last few days.

How did this happen?

The absence of code reviews and security reviews allowed it to happen.

The fact that an employee was able to leave a time-bomb proves that there is no security programme in place.

What is your policy for change control ( Software installs)?

Code reviews i.e. code should be reviewed by peers before it is allowed to be pushed to the code base.

Every software install should be monitored/approved by the IT department.

What needs to be modified or changed?

Company policies should be modified. Strong screening of new hires, in-depth interviews. only hire good people, to begin with.

Eliminate employees who employ questionable practices.

What should be your long-term strategy for departing staff?

Departing staff should be made to serve a longer notice period while the company finds a suitable replacement.

An unpleased employee is more likely to cause damage hence effective management and unbiased appraisal systems should be there.

What should be your general policy on employees who are leaving?

Exit interviews should be conducted.

should you have the same policy for both technical and non-technical staff?

The technical staff should serve a longer minimum notice period before leaving

should departing staff be allowed to make software installs?

No, the departing staff shouldn't be allowed to make software installs. A disgruntled employee can cause data breaches and might cause a leak of critical data. Hence the IT department should keep a close check on the departing staff.