I work in the information security team at my company in a senior role. I have been asked by my manager to coach / train new and more junior members of the team.
A somewhat common occurrence I have seen is that these junior team members are often very keen to suggest changes to procedures / processes / security architecture etc. Security is a delicate operation in which risk and end users needs must be balanced. It is a constant exercise of risk management, as benefits of security controls must be balanced against potential side effects.
Very often, more junior team members are somewhat overly - excited to begin security remediation / architectural / policy changes without what I feel is adequate consideration of end user needs / risk management / future needs. I would hate to architect a solution only to have it be temporary and short lived.
What can I do to train other team members to temper their enthusiasms with out shutting down feedback for needed changes?