New IT hire getting full server access — is a background check mandatory?

Under the German Federal Data Protection Act, employee data collection is bound by the principles of necessity and proportionality. Requesting a criminal record certificate is only valid to the extent the job duties justify it; irrelevant past offenses cannot serve as grounds to withhold employment. Having an employment law specialist document this procedure will prevent potential liability risks.

Don't assign generic, shared root access. Hardware-token MFA must be mandatory at login, and all 'sudo' commands should stream in real time to a centralized, immutable log server. The engineer needs to know that every single command leaves an independent audit trail. That deterrent is far more effective than any background check.

Don't hand over full permissions right off the bat tomorrow. The statutory probationary period (Probezeit) in Germany is the best tool for this kind of trust test. Roll out access rights gradually over the first six months; start with test and development environments, and make access to production systems conditional on pairing up with the team lead.

Do you have any specific commitments regarding staff vetting in your service level agreements (SLA) or data processing agreements (AVV) with clients? Corporate clients can sometimes require employees to hold certain security certifications or undergo annual security training.

Ten years ago, out of similar concerns, we put such strict restrictions on a newly hired sysadmin that the guy quit in his second month; he said, 'if you don't trust me, why did you hire me?' And he was right. Instead of looking for security clearances, we now do extremely thorough reference checks during hiring. Speaking directly with their previous managers to ask about their integrity in crisis moments gives us way more insight than any background check on paper.

an official background check is a state thing anyway they won't let us run one. I mean we just ask for a clean criminal record plus we disabled root login completely on servers everyone logs in with their own account and uses sudo logs go straight to an external cloud.

Edit: asked below, I wrote the answer in the second message.

To properly secure the infrastructure, implement these three steps: 1) Restrict direct access to production databases via VPN and IP whitelisting. 2) Enforce the four-eyes principle for critical configuration changes. 3) Set up a centralized identity provider so that all permissions can be revoked with a single click when an employee departs.

Good call starting this thread.

Let me share what happened to me; it might be useful. Security isn't absolute; it's about making attacks not worth the effort.

If you have questions, write them; I'll answer as best I can.

Thanks for writing this, that's the right way. The real issue isn't the number, but what it's based on.

The real issue isn't the number, but what it's based on. If you post the result here, it will help others too.

Let me speak from the other side; I'm on the supplier side. like the biggest time-waster for us was not knowing who had the final say.

Thats all sorry if I went on too long.

Thanks for writing this, that's the right way. An untested backup is not a backup.

If I were you, I'd go this route.

Exactly, and not many people know this. Security isn't absolute; it's about making attacks not worth the effort.

here's how it went for us.. then when making decisions write down the worst-case scenario too, not just the best.

if you get three different answers on a topiic the question was asked wrong.. and correct me if I'm wrong.

I'd appreciate it if you shared the outcome.

We've heard this a lot, but it never happened like that for us. If it's your first time, start small; scaling comes later.

If you have questions, write them; I'll answer as best I can.

Let me summarize the topic, since several different answers were given. Most incidents start with a leaked password, not a vulnerability.

If it's your first time, start small; scaling comes later. Of course it varies if your situation is different.

I completely agree. The answer varies greatly by industry; there is no one-size-fits-all rule.