3

Posting from real account now

I work on the IT security team at my employer as a senior analyst / engineer. A part of my job duties is performance reporting to senior management on certain cybersecurity metrics. As I understand and was told to me by management reporting directly to CISO, these are to be used mainly for internal operational process improvement, not to point fingers at anyone or call individuals out for weaknesses in their role.

Today, I received request from senior management for individuals who have been demonstrating weaknesses in phishing reporting and recognition of malicious emails. I understand management having these names will help in assessing what our social engineering risk exposure is, but feel it's unnecessary and eroding trust with other employees. The folks may think this is a back stab and request feels unreasonable to me.

From my prior work experience in cybersecurity, building trust with end users is critical to achieving business goals. I am a respected senior member of the team and given considerable leeway in making decisions.

Edit to incorporate responses to comments:

@ThursdaysGeek, we do "additional training" for users who consistently have issues via in person followup now. Either I or a colleague would work with the end user directly. For high value whales (i.e: Executives and senior management), SecOps manager communicates with them.

@JcMack - All employees are required to complete annual security training. If not completed, then before end of year, access to company IT resources for non - compliance folks is removed. Clickers in the past have shown certain trends and the types of employees having these issues is rather expected.

If there are fellow security practitioners on here, I would love to hear what you did if you faced a similar circumstance before. Specifically:

If targeted training were to be implemented, how would you learn what social engineering exploits are in the wild now?

How would such targeted exercises work? We already have top management buy in (CISO)

Is my belief that requested data is unnecessary reasonable?

How can I balance fulfilling my duty in my role, to protect company assets, against supporting my fellow colleagues in this situation?

If offering management anonymized data is appropriate, how can I best make this request professionally?

  • 2
    Would people who consistently fail phishing tests get additional training? Would that be useful? – thursdaysgeek Jun 17 at 23:19
  • Yes, depending on severity and frequency. If we catch any whales, of course we speak to end users – Anthony Jun 17 at 23:25
  • Data comes from simulated phish emails we send. As I posted on infosec stack exchange, we already getting some grumbling from end users, so I am really hesitant to release individualized data – Anthony Jun 17 at 23:27
  • Some parts after "If there are fellow security practitioners on here" are off-topic, i recommend removing it. security.stackexchange.com is the place to ask that – aaaaaa Jun 18 at 6:59
  • What does your SecOps manager think about the request? – Smock Jun 18 at 13:09
9

Building trust is important. So is safeguarding your company.

If specific employees are repeatedly failing phishing tests, then it is to the advantage of the company to give them additional training, so they can learn. Or provide some level of punishment, so they can learn. Or remove them from the opportunity to access email or the internet, to safeguard the company.

Generalized training is good. But when 99% of the people have learned, and 1% of the people continue to be click-happy, it doesn't do as much good to continue with generalized training. At that point, something more directed is needed.

As an employee, I have more trust if my employer takes care of specific problems, rather than giving generalized advice and lets the problem continue.

But, to answer your question. If offering management anonymized data is appropriate, then you come up with reasons why the anonymized data is of more value to the company than the reasoning above. Then you explain that. If they agree, then you provide only the generalized information. If your argument doesn't convince them, then you'll need to do as they ask anyway.

That's always the professional way to approach any* issue, when you disagree with management: Give them compelling reasons for your stance, and then follow the directions, perhaps changed because of your reasons.

*Any being defined as legal, of course. When asked to do something that is illegal or unethical, then simply giving reasons and then doing what you are told is not always appropriate.

  • I agree with Joe, that sentence is gold. The thing about phishing attacks is, it only takes one failure. It literally doesn't matter if 9,999 people in a 10,000 person company get it right, if that one person gets it wrong. Regarding your "answer your question" paragraph - the danger with trying to convince upper management to accept an alternative is, if you don't know their motivations, you will likely mis-attribute the value of your alternative. In other words, even if you think anonymous data will be helpful, it may not be, and trying to explain why it is might end up very awkward. – dwizum Jun 18 at 13:20
  • I clicked on a phishing test once. And it affected my review that year. Because of that, I put additional safeguards in place, so it never happens again - it's not just to the company's benefit that I don't click, it's to my benefit as well. – thursdaysgeek Jun 18 at 15:28
5

The existing answers agree with your view that this is an inappropriate request. Asking for the list of individuals is entirely acceptable - it’s important for the security of your firm.

If you do disagree with the request, express your dissent and perform your role according to the decision made by management.

You should not delay or offer different information than what was requested if you are able to fulfill the request on time and in a way that meets expectations.

Phishing is a major source of security breaches for companies. Identifying and having constructive conversations with individuals who continually perform poorly in simulations is common in organizations of all sizes. This activity is in the best interest of your organization, even if a few folks may be a bit embarrassed.

-1

Is my belief that requested data is unnecessary reasonable?

The exact list of individuals that are the source of malicious email security incidents doesn't seem reasonable to me. It does feel to some extent finger pointing and what happens if someone else not on the list clicks on a malicious link tomorrow? It doesn't solve the security problem at its root. I think providing aggregated statistics on these individuals is reasonable. For instance, the total number of people on the list month over month and whether that's increasing or decreasing. I'd like to see the number of managers, executives or those with high access on that list or if particular jobs roles are more likely to click the malicious link.

  • Everyone is required to complete security awareness training annually. Would you mind updating your answer? There are trends among clickers and devs are frequent amongst them. As you developer, can you give your thoughts to this specific employee type? – Anthony Jun 17 at 23:48
  • Interesting. Is it because your company has a higher number of devs versus non-devs (hence more clicks from devs overall)? Wearing my developer hat, I can just say that a number of our internal systems have improper security settings and I have to ignore warnings to do my job every day. Does that bleed over to actual system where I should worry about security? Probably. – jcmack Jun 18 at 2:48
  • There are trends among clickers and devs are frequent amongst them Yikes. Devs often have elevated security rights. That's the worst place to have a failure. I understand concern over protecting individuals, but there comes a time when an employer needs to protect itself for the greater good. – dwizum Jun 18 at 13:23
-3

I generally agree with other answers: it is your job to follow instruction of the management (within legal scope of course)

It is also your job to perform your duties professionally and with the best ability you can. In this particular situation you consider the request to go against your professional judgement. You are saying:

From my prior work experience in cybersecurity, building trust with end users is critical to achieving business goals. I am a respected senior member of the team and given considerable leeway in making decisions.

Imaging if you were asked to open some ports that are necessary for CEO's software (khm, games). You have to comply, but you also know it will hit you and your company back.

As an engineer, if is not your job to blindly follow the instructions (not in the army), but it is your job to solve problems. What is the problem your managers want to solve? You were hired to provide best of the solution. They should understand it.

if they don't understand it, you better do what you've been told and update your resume: your management doesn't trust or value you, and your users might make your life worse very soon.

PS: you can also suggest to the management to consider what will they do if their names are on the list

  • No, one absolutely DOES NOT have to comply with improper requests. From my prior experience in InfoSec and trusted systems development, if someone asks me to do something wrong my career -- future tense -- is on the line. At a previous job I had routine requests to "hack" into a machine "because so-and-so forgot the password / was on vacation / etc." My stance was I'll do it with a managers signature on a piece of paper. I never, not once, got that piece of paper. – Julie in Austin Jun 20 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.