Request from management that I disagree with

Question

Posting from real account now

I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain cybersecurity metrics. As I understand and was told to me by management reporting directly to CISO, these are to be used mainly for internal operational process improvement, not to point fingers at anyone or call individuals out for weaknesses in their role.

Today, I received request from senior management for individuals who have been demonstrating weaknesses in phishing reporting and recognition of malicious emails. I understand management having these names will help in assessing what our social engineering risk exposure is, but feel it's unnecessary and eroding trust with other employees. The folks may think this is a back stab and request feels unreasonable to me.

From my prior work experience in cybersecurity, building trust with end users is critical to achieving business goals. I am a respected senior member of the team and given considerable leeway in making decisions.

Edit to incorporate responses to comments:

@ThursdaysGeek, we do "additional training" for users who consistently have issues via in person followup now. Either I or a colleague would work with the end user directly. For high value whales (i.e: Executives and senior management), SecOps manager communicates with them.

@JcMack - All employees are required to complete annual security training. If not completed, then before end of year, access to company IT resources for non - compliance folks is removed. Clickers in the past have shown certain trends and the types of employees having these issues is rather expected.

If there are fellow security practitioners on here, I would love to hear what you did if you faced a similar circumstance before. Specifically:

If targeted training were to be implemented, how would you learn what social engineering exploits are in the wild now?

How would such targeted exercises work? We already have top management buy in (CISO)

Is my belief that requested data is unnecessary reasonable?

How can I balance fulfilling my duty in my role, to protect company assets, against supporting my fellow colleagues in this situation?

If offering management anonymized data is appropriate, how can I best make this request professionally?

Answer 1

Building trust is important. So is safeguarding your company.

If specific employees are repeatedly failing phishing tests, then it is to the advantage of the company to give them additional training, so they can learn. Or provide some level of punishment, so they can learn. Or remove them from the opportunity to access email or the internet, to safeguard the company.

Generalized training is good. But when 99% of the people have learned, and 1% of the people continue to be click-happy, it doesn't do as much good to continue with generalized training. At that point, something more directed is needed.

As an employee, I have more trust if my employer takes care of specific problems, rather than giving generalized advice and lets the problem continue.

But, to answer your question. If offering management anonymized data is appropriate, then you come up with reasons why the anonymized data is of more value to the company than the reasoning above. Then you explain that. If they agree, then you provide only the generalized information. If your argument doesn't convince them, then you'll need to do as they ask anyway.

That's always the professional way to approach any* issue, when you disagree with management: Give them compelling reasons for your stance, and then follow the directions, perhaps changed because of your reasons.

*Any being defined as legal, of course. When asked to do something that is illegal or unethical, then simply giving reasons and then doing what you are told is not always appropriate.

Answer 2

The existing answers agree with your view that this is an inappropriate request. Asking for the list of individuals is entirely acceptable - it’s important for the security of your firm.

If you do disagree with the request, express your dissent and perform your role according to the decision made by management.

You should not delay or offer different information than what was requested if you are able to fulfill the request on time and in a way that meets expectations.

Phishing is a major source of security breaches for companies. Identifying and having constructive conversations with individuals who continually perform poorly in simulations is common in organizations of all sizes. This activity is in the best interest of your organization, even if a few folks may be a bit embarrassed.

Answer 3

Is my belief that requested data is unnecessary reasonable?

The exact list of individuals that are the source of malicious email security incidents doesn't seem reasonable to me. It does feel to some extent finger pointing and what happens if someone else not on the list clicks on a malicious link tomorrow? It doesn't solve the security problem at its root. I think providing aggregated statistics on these individuals is reasonable. For instance, the total number of people on the list month over month and whether that's increasing or decreasing. I'd like to see the number of managers, executives or those with high access on that list or if particular jobs roles are more likely to click the malicious link.

Answer 4

I generally agree with other answers: it is your job to follow instruction of the management (within legal scope of course)

It is also your job to perform your duties professionally and with the best ability you can. In this particular situation you consider the request to go against your professional judgement. You are saying:

From my prior work experience in cybersecurity, building trust with end users is critical to achieving business goals. I am a respected senior member of the team and given considerable leeway in making decisions.

Imaging if you were asked to open some ports that are necessary for CEO's software (khm, games). You have to comply, but you also know it will hit you and your company back.

As an engineer, if is not your job to blindly follow the instructions (not in the army), but it is your job to solve problems. What is the problem your managers want to solve? You were hired to provide best of the solution. They should understand it.

if they don't understand it, you better do what you've been told and update your resume: your management doesn't trust or value you, and your users might make your life worse very soon.

PS: you can also suggest to the management to consider what will they do if their names are on the list