How can I help team members be more discreet and judicious?

Question

I am an IT Auditor and the lead for the team. Our team has access to very sensitive data such as:

• Audit findings
• Pen testing results / vulnerability scans
• Audit committee correspondence

If some of these items are not kept confidential prior to being remediated, (e.g: pen test report), then security vulnerabilities of the company may be exploited by insiders. Other items such as audit committee correspondence contain sensitive corporate governance information meant only for a few select teams / individuals to know.

Today, a team member started to discuss information classified as sensitive at lunch where colleagues from multiple outside teams were present. I cut the person off and reminded him not to discuss sensitive issues outside of the select individuals who needs to be privy to this information. This has been the second instance in about 3 months when this team member made the judgment lapse.

All employees take security awareness training annually in which data protection / disclosure is covered. I can be very prescriptive by setting and enforcing rules but want to take a more personable approach to solve this issue. In my profession, (InfoSec and IT GRC), discretion and restraint are necessary traits for an employee to have. In my previous question here, I encouraged team members to rely more on their professional judgement. By taking a prescriptive approach through strict enforcement of rules, I feel I would send a mixed message to the team. Listing exactly what information should / should not be shared with whom is not feasible because the decision depends on circumstances of the situation.

How can I encourage team members to be more discreet and show better restraint when discussing issues without relying solely on enforcement of rules?**

Answer 1

How can I encourage team members to be more discreet and show better restraint when discussing issues without relying solely on enforcement of rules?

While clear rules are good (and IMO essential) to ensuring secure behavior in situations like this as you've discovered humans aren't always great at following them when the rule is all they have, it's too easy to fall into the trap of seeing the rules as arbitrary or even as unnecessary. You're always going to get better compliance with them if you can get the staff to buy in to the goal of the rules.

To do that you might find it beneficial to explain in plain language to them why the rules exist and what the potential damage could be if someone doesn't keep to them. If you can explain how a breach would hurt them (not just in the context of being disciplined for not following the rules) all the better. Something like:

These rules are there to protect the company - and if the company gets hurt badly by a security breach then it may not be able to continue to afford to pay us so these aren't arbitrary rules or a stick to beat you guys with. They are there for your protections and that of the company so I need you all to adhere to them and to err on the side of caution when it comes to discussing/revealing any potentially sensitive information you are privy to.

Answer 2

You have two directions of action: toward your team and toward your managers/organization.

Toward your team:

• sanction violations when you are aware of them (like you did in your example)
• remember the team the vital importance of keeping confidential information as such, i.e. during team meetings reserve some time to get back on the topic
• lead by example

Toward your organization:

• make visible that a training once a year is not enough
• propose to set up a reward program for good behaviors (i.e. reporting problems, suggesting improvements, security tip of the month award, etc.) so that the employees perceive the importance of keeping confidential information reserved for the entire company, and not just because you are the one who nags about it

Answer 3

Simply remind all team members of their responsibilities in this respect.

Can I remind the team that no one should be discussing confidential/sensitive information with people outside the team, or in places where those discussions can be overheard by others. Please let me know if there's any questions.

Email should be fine for this. The team should be aware (through their training) of the need and reasons for discretion, but just need reminding to keep their mouths shut.