I am an InfoSec professional working as an IT auditor. For several months now, I have working closely with our information security team to strengthen the security controls governing our PCI and SOX compliance efforts. Last week, new security policies went live in the production environment. In response to a comment by @Lilienthal, we are implementing these safeguards to better safeguard the production environment containing card holder data, customer PII data, and non public financially sensitive data from unauthorized access / use by employees without a need to access this information. The new controls came about both due to compliance requirements (i.e: PCI) and also to strengthen our security due to customer security being necessary and the right thing to do.
@Brandin, the new policies were communicated through joint emailing between our team and the IT Security team.
@JAB, developers either have no access or R- only access to the production servers. However, other teams such as the IT Security and DBA do have frequent needs to access the production environment, which somewhat prompted such a process change.
As examples, the following requirement is now in effect: (among others)
- Access to production servers must be through a jump box proxy.
Before these new changes became effective, as long as an employee had logical access to a production server, he / sh could directly access the server from his / her end point machine. Now access to sensitive company and customer data is centrally controlled through a proxy rather than individual end point user computers.
This week, our team has been getting complaints from IT and non-IT users that the new security measure are getting in the way of them performing their jobs. It seems that the end users don't really see the purpose of the new policies, although it was explained to them through a joint effort of both our teams.
As monitoring security and internal controls compliance is part of my job, I don't to go to my manager unless absolutely necessary as it seems I am unable to do my job. I also do not to alienate coworkers as I will most likely need their cooperation in the future.
When faced with resistance from other employees in implementing what is ultimately necessary and beneficial to the company, how can one best explain the situation diplomatically and effectively?