Security issues with freelancing work on an existing website

Question

I currently have a website that has been recently completed. I'm contemplation using a freelance service such as SO for all future components. There is a considerable amount of work to be completed on-top of the existing infrastructure.

I've tried searching for an answer to this question, but it's so generic in terms that it's difficult.

My site is fairly complex using relational databases, MySQL, PHP, Javascript, JQuery, and Ajax.

I'm concerned about using a freelance worker on the site in regards to giving them admin access to the server and allowing them to access the existing databases. Is there a tried and true way to handle / manage this? I'm open to allowing it, but what safety precautions and other ideas do you have to prevent mischief?

Answer 1

This is one of those, there's no real right answer. On one hand, you can severly restrict access to the freelance developer to the point where he/she will be frustrated, or even restricted to do what they need to do.

On the other hand, if you give full access of course there is the risk that they can cause some heartache, especially with your data.

I'd be leaning more towards the latter, provided you find somebody you can trust. I'm not a MySQL guy but I know that with SQL Server you can audit what happens to the instance/database to a very granual level. So you will know what they are doing for the most part.

Answer 2

I suggest making a clone in a development environment to minimize damage if something does happen, intentional or not.

Otherwise, make sure to use ftp/database passwords that are unique to this project only. Make a full site backup including files, settings, and database.

I agree with Shark that you don't want to hinder work performance with extreme security measures. In the end its all up to you and how important this data is. There may be some better solutions that require some time and resources if you have them, but I am under the impression you just want to get the damn thing up and running.