I manage a team in the cybersecurity division where I work. My team is responsible for owning several security tools used to protect company digital assets (Data loss protection suite - DLP, advanced end point protection, internet proxy software).
Several security incidents that resulted in business disruption over the past years were due to risky behavior of the end user such as successful phishing or downloading work related, but tainted, software from disreputable websites. Analysis of mock phishing exercises and audit logs revealed a pattern of the problematic users
In addition to continuing mock phishing exercises and blacklisting disreputable websites hosting tainted software, we have started a proof of concept (POC) of tools that will provide real time coaching to end users upon detection of risky behavior, such as:
- Visiting P2P sites
- Clicking external email links with forged addresses
- Downloads of code libraries from non trusted hosting sources and potentially containing exploit code.
To give 2 examples of real time feedback being tested:
User A clicks on a Torrent P2P site or downloads a p2p file sharing client. Access to site and / or download is first blocked. In addition to the block message, KnowBe4 module would provide the user with customized feedback right then and there indicating why p2p sites are risky (e.g: backdoor shell programs allowing C/C , ransomware, unknown botnet participation etc.)
Developer downloads a code library from a disreputable hosting site and scan reveals exploit code / malicious executables. Another tool would first block download and then KnowBe4 would coach in real time.
The feedback from the small POC group of test employees (customer facing users and IT users such as developers chosen based on past patterns of user behavior) is mainly that the real time feedback seems too intrusive, big brother like, and creates distrust that end users are incapable of distinguishing safe from unsafe cyber behavior.
Senior management feedback is that POC results are very beneficial and they want to enhance the baseline security training cyber division provides all employees with the above described real time coaching functionality, and I / team agree.
Would you consider real time , automated feedback based on insecure cyber behavior to be intrusive or unreasonable?
How can our team mitigate the complaints from the POC while not going against what our division and senior management wants (if possible)?
Edit: Responding to comment to show how coaching works
For mock example, watch the video from KnowBe4 at 1:06 for what a coaching message may look when users go to Twitch TV to stream. The content of the security tip is fully customizable by us. To be clear, this is hypothetical only.
Edit: The examples I gave are not the only examples of risky behavior. E.g: Around end of Q1 each year, our DLP alerting software would go into overdrive, mostly caused by employees emailing their W2 and 1099 forms to themselves. To respond to comment as to what expected response is from end user, we have portal where these documents can be viewed and HR also mails hard copies in the mail for tax reporting purposes.