How to help new team member with security best practices without escalation to management

Question

I currently work on the Information Security team at my employer and have been working at my company for about 4 years. Recently a new member joined the team, who per his resume has about 1.5 years of experience in cybersecurity. He has never worked in a SOC before.

I was instructed by my manager to mentor/train this person, but will not be his direct manager going forwards. He is generally smart but has some sloppy work habits that don't really follow best practices. We work with highly sensitive customer credit card, financial, and health data so proper security is essential. Our industry (insurance and healthcare) is tightly regulated.

Some of his actions are "loose" and somewhat "sloppy" such as lapses in communication before making a change to production security components (e.g: firewall, DLP software, IPS, and SIEM etc.), using domain admin credential for system administration tasks that don't require that high level of access, and not logging actions properly in audit logs. While he appears to know what he is doing, I am afraid that such actions may mean he may one day make a critical error in PROD that he may not be able to recover from and I may or may not be able to.

We do have a robust security policy and are a large company. However, I don't want to escalate to my manager yet, as he is new and I want to give him a chance first. When I talked to him about my observations, he stated he is just more used to doing things this way, and it's more efficient.

Question

How can I, without relying on my manager or formal company policy, assist this new team member with changing his behavior?

If informal methods don't work, should I escalate this and how without throwing the new person entirely under the bus?

Answer 1

[...]used to doing things this way, and its more efficient.

Every time he violates a policy point it out to him in a friendly but serious manner.

If he answers similarly again or even while you point it out, tell him "it may not be the most effective way" or "you know it's a hassle to do this way" or "yeah, it is cumbersome"

BUT

"it is the protocol", "is required by law or the policy" or "has to be done here without exception".

Make sure he understands that you all had to change habit to adapt policies and that they're enforced by management for a reason.

If applicable give an example of what could go wrong and / or what his punishment or consequences would be for him, the team and the comany.

If you see after a couple of instances that he won't change, create a paper trail by sending "helpful" email reminders.

• "as per our discussion today" or
• "when I mentioned we need to do X instead of Y" or
• "hey, do you remember when you did X and I said Z could happen"

...and then follow up by citing or explaining / quoting

• a similar case you read on the internet

• a section of the policy hand book

• an applicable law regarding his infraction

• a security article in a journal

Follow up by reiterating what you said to him earlier.

This way, you're not admonishing him (taking on a superior position to your peer that you don't have), simply guiding him and showing effort to be helpful to him.

You'll probably get through with less resistance AND in case he ever screws up or you end up having to eventually escalate his negligence to management or security or a superior witnesses him doing something and asks you if you told him it was not allowed, you can present proof of your mentoring and your instructing him on the company policy.

Also, remember, you have no leadership position so you can't really enforce his change in behaviour, only show him how it is expected to be done at your company.

If he ever causes an incident, it is not your responsibility what another adult does who is not your subordinate (even then there are limits).

Answer 2

I assume you do not know about his intentions (why he is being sloppy). In this case, I would go progressively:

1. Tell (again) about the fact that there are security policies because of the respective reasons. Tell him nicely that you noticed some situation when he did not follow exactly some details of the policies.

Ideally, the policies are written and you can show it to him (maybe send a link to the policies by email after the discussion).

2. After some time (days, weeks - whatever you find reasonable), have a follow-up - especially if there is no improvement (or too slow of an improvement). In this discussion, tell him that you will have to involve management if he continues to be distracted from following the policies. Offer your colleague the following "deal": he should request from his manager trainings and / or coaching. In this way, you give him a chance to save face (again).

3. If this does not work also, involve management - your boss first. Together with your boss, decide the next steps.

Note: each step above may actually have several discussions and follow-ups. I do not imply in any way to reach CEO level in 4 discussions :)

Answer 3

We do have a robust security policy and are a large company

No good policy is good enough unless it is "implemented" (enforced?).

From your description, it appears that the security and integrity is one of the key factors for your work - so you need to ensure that the policies are upheld.

Policies are there for a reason, so as not to allow sloppy mistakes ruin a day. However confident someone might be on their instincts, if there is a laid out policy, we should follow it - it's a no-brainer.

Given that you are in charge for the mentoring - you need to "enforce" it. If you cannot get the message across via friendly communication, make it official. Involve him into a meeting / discussion and point out these observations and mention, these are gross violation of the security policies and when any audit happens, it will create a big problem for him as well as for the team.

Allow some time to him for getting rid of the policy-breaking habit.

Even after some time the behavior does not change, escalate it to your manager. There's no way to sugarcoat it. You tried your best and failed to improve him - not your liability anymore.