How can a cybersecurity team mitigate internal customer complaints that real time user training is too intrusive?

Question

I manage a team in the cybersecurity division where I work. My team is responsible for owning several security tools used to protect company digital assets (Data loss protection suite - DLP, advanced end point protection, internet proxy software).

Several security incidents that resulted in business disruption over the past years were due to risky behavior of the end user such as successful phishing or downloading work related, but tainted, software from disreputable websites. Analysis of mock phishing exercises and audit logs revealed a pattern of the problematic users

In addition to continuing mock phishing exercises and blacklisting disreputable websites hosting tainted software, we have started a proof of concept (POC) of tools that will provide real time coaching to end users upon detection of risky behavior, such as:

• Visiting P2P sites
• Clicking external email links with forged addresses
• Downloads of code libraries from non trusted hosting sources and potentially containing exploit code.

To give 2 examples of real time feedback being tested:

• User A clicks on a Torrent P2P site or downloads a p2p file sharing client. Access to site and / or download is first blocked. In addition to the block message, KnowBe4 module would provide the user with customized feedback right then and there indicating why p2p sites are risky (e.g: backdoor shell programs allowing C/C , ransomware, unknown botnet participation etc.)

• Developer downloads a code library from a disreputable hosting site and scan reveals exploit code / malicious executables. Another tool would first block download and then KnowBe4 would coach in real time.

The feedback from the small POC group of test employees (customer facing users and IT users such as developers chosen based on past patterns of user behavior) is mainly that the real time feedback seems too intrusive, big brother like, and creates distrust that end users are incapable of distinguishing safe from unsafe cyber behavior.

Senior management feedback is that POC results are very beneficial and they want to enhance the baseline security training cyber division provides all employees with the above described real time coaching functionality, and I / team agree.

• Would you consider real time , automated feedback based on insecure cyber behavior to be intrusive or unreasonable?

• How can our team mitigate the complaints from the POC while not going against what our division and senior management wants (if possible)?

Edit: Responding to comment to show how coaching works

For mock example, watch the video from KnowBe4 at 1:06 for what a coaching message may look when users go to Twitch TV to stream. The content of the security tip is fully customizable by us. To be clear, this is hypothetical only.

Edit: The examples I gave are not the only examples of risky behavior. E.g: Around end of Q1 each year, our DLP alerting software would go into overdrive, mostly caused by employees emailing their W2 and 1099 forms to themselves. To respond to comment as to what expected response is from end user, we have portal where these documents can be viewed and HR also mails hard copies in the mail for tax reporting purposes.

Answer 1

If folks have a better idea for a way to give employees the necessary training and help them catch the occasional mistake, that would be great. But all that has really changed is that they are being reminded to follow existing company policy.

If these are false alarms, you improve the tools to intrude less.

If these are genuine bad practices, the proper answer is "if you find it intrusive, you are doing things you shouldn't. Stop doing them and you won't find the tool intrusive. If you have a legitimate exceptional case, talk to us and we'll figure out how to handle it."

Unless you have an exceptional contract (or exceptional privacy laws that I don't believe are actually in effect anywhere), you have no reasonable expectation of privacy when using the company's network connections. The security team was already looking for use patterns that suggested a risk. All that's changed is that the end-users are being warned automatically... which is probably preferable to asking their managers to warn them.

No, the "annoy-o-tron" pestering isn't an ideal solution. Yes, it is distracting and sometimes inconvenient. But given today's computing security requirements, where paranoia may not be enough, this is actually a relatively low impact way to address legitimate concerns. Users will quickly learn what provokes these messages and find better ways to get their jobs done.

It does probably mean there are some personal computing tasks you can't do at work, at least not without supplying your own hardware and network connection. But given that most of us now have those resources with us at all times in the form of a smart phone, we do have alternatives.

If it gets in the way of legitimate business tasks... See first three paragraphs. And accept that security and convenience will never be completely comparable; the balance will always be evolving, and nobody will ever be completely happy.

Answer 2

I'd be looking at the systemic reasons why your developers are having to use P2P sites or disreputable code libraries!

The problem with this kind of pestering is that people eventually tune out, if the systems within which they work cause them to encounter the pester repeatedly, if the usual correct response is to press on past the warning, and if it's practically impossible to discern the circumstances in which they shouldn't press on.

It's like a farmer handling haystacks getting an occasional warning that some may contain needles. Without even knowing whether one or more needles is present in any particular haystack, how exactly is he to react? He has a hundred haystacks to shift that day, how long is he to spend searching? Or does he just stop moving haystacks and wind up the business?

There's a strong tendency amongst IT professionals to promote the narrative that users are simply careless when it comes to cybersecurity.

In reality, detecting cybersecurity risks is an expert task (because there are world experts applied to the task of creating those risks in the first place), and even experienced professionals cannot do it consistently.

This is in the same way that no reasonable amount of human labour alone can consistently find needles in haystacks (and only allocating a minority with extreme patience and perceptual skills, and taking an extreme amount of working time, would hope to find even some of the needles).

Your end-users may phrase their problem with your scheme as indicating a lack of trust in their ability to discern safe and unsafe online behaviours. What they are probably meaning to say, is that your scheme indicates a lack of trust in their conscientiousness, and this scheme emanates from that lack of trust, rather than from a serious analysis of the difficulties.

You are the farm-master putting signs all over the walls, telling the hands to look out for needles in the haystacks.

Answer 3

I think a lot of the issues people have with systems like this is that the focus is completely backwards. Most people see IT departments as focused on identifying and protecting against external threats. They maintain firewalls to keep threats out, they analyze logs to identify new threats, and they scan incoming email to filter out malicious content. You are creating a shield to keep external bad actors out so that employees can work in peace.

From a user's point of view, the system that you describe has the business end pointed in the other direction. It's not monitoring for external threats, it's monitoring the people that you're supposed to be protecting. That naturally makes people feel like you're lumping them into that same category of threats that you're normally protecting against. Yesterday you were part of the company, under IT's umbrella of protection. Today, IT booted you out from that umbrella and now has to protect the company against you.

Take your second example for instance. Your system "coaches" the developer after downloading a library from a shady site. The user's expectation was that they might get a message saying something like "This download has been blocked because malicious content was detected. Access to this website will be restricted until IT Security can review the trustworthiness of this site", where the focus is on the external threat. Instead, they get a message like "You messed up. Here's what you need to do differently to avoid harming the company". In the first instance you're protecting the user against an external threat. In the second case, you're saying that the user is the threat and you're acting against them to protect the company. It's inherently antagonistic, and it feels shocking coming from a group that has until now been on your side.

A lot of the "intrusive-feeling" aspect of this particular system is the way it delivers these coaching messages. Instead of getting a "resource blocked" message in the web browser, you get an email or IM with a "coaching" message. These are personal and directed forms of communication. You're not putting up a wall blocking all traffic to a malicious site, you're watching my specific behavior individually and then sending "I saw what you just did" messages as soon as I do something that you don't like. That's really creepy, particularly if the messages are sent almost immediately. Even in an environment with no expectation of privacy, and even if you're not doing anything wrong, nobody's comfortable when they feel like the IT police are hiding in the bushes with binoculars, watching and recording everything they do.

As a simpler example, I drove through a construction zone the other day that had a temporarily-reduced speed limit. The "construction zone" sign had a speed sensor and a screen on it that would display how fast you were going. If you exceeded the new speed limit, the screen would flash "SLOW DOWN". Imagine instead that it was just a plain wooden sign and after you drive past, your phone rings and a voice on the other end says "you're driving 10 mph over the speed limit, you should really slow down *click*". Both systems accomplish the same thing, but the second one does it in such an intrusive and personal way that people will be extremely uncomfortable with it.

Any system you implement will not be successful without buy-in from those using it. This kind of feedback should be a clue that however useful you think it will be, users will fight it and do what they can to work around it. Instead, you should be able to get most of the benefits without creating an uncomfortable or antagonistic environment. First, keep the focus on the external threats. Your messaging should not be "you created a security risk", it should be "a security risk was detected and has been blocked". The underlying action was the same but the tone is neutral and impersonal. Instead of singling out people after they've done something wrong, make sure everybody in the company is getting annual security training and verify that they've learned the important concepts. Hold periodic 5-10 minute refresher courses where you talk about the specific types of incidents that your systems have detected and what can be done to avoid them. Not only would people not feel like they're singled out for surveillance, but you'd be educating the rest of the company before they make a mistake. You're much more likely to get employee buy-in from something like that. Singling out individual users should be reserved for those with particularly egregious or frequent mistakes, and even then it should be done via a conversation with an actual human, not a message from the IT surveillance bot.

Answer 4

the real time feedback seems too intrusive, big brother like, and creates distrust that end users are incapable of distinguishing safe from unsafe cyber behavior.

I'm not familiar with the specifics of this product, but how intrusive is this really, and is there anything you do can do make this less intrusive? Is it just a popup that they can immediately close, or is it something more persistent and disruptive to their workflow? If they're customer-facing, is it having causing issues while they're dealing with customers? Can you get any feedback from them about what specifically they find so intrusive, and what they would consider acceptable?

Senior management feedback is that POC results are very beneficial and they want to enhance the baseline security training cyber division provides all employees with the above described real time coaching functionality, and I / team agree.

What is this view based on? Do they have actual data to demonstrate that this real-time coaching has reduced the number of security incidents, compared to these actions just being blocked? That it has resulted in a meaningful and measurable change in behaviour?

If you have real evidence that this approach works, then you have a much stronger argument for why rolling it out further, and can make that argument to your staff. But this is just management feeling like it's very beneficial without any actual evidence then you're going to struggle to convince people, as it will sound like management just jumping on the latest trendy bandwagon.

The feedback from the small POC group of test employees (customer facing users and IT users such as developers
[..]
Senior management feedback is that POC results are very beneficial

It may not be a coincidence that the people who are in favour of it are not the ones who it's being applied to, and the people who it's being applied to are not the ones in favour of it.

Roll it out to all the senior managers who think it's "very beneficial" for a few weeks or months, and see if they still give the same positive feedback.

And if after a few months you can say "We've extended the pilot to the management team, they're all still in favour of it, it's led to a $percent reduction in security incidents, which has saved $time and $money" then that's a pretty strong argument, and it sounds like a good idea to deploy it more widely.

And if you're not able to say that after a few months, then perhaps you need to reconsider whether this solution is really as good as you think it is.

---

And as a wider issue, you need to have a serious look at the shadow IT in your organisation. If your users are torrenting stuff, accessing P2P sites and downloading random libraries/binaries/etc then you need to look into why they feel the need to do this - because none of those should be happening in a professional environment.

Answer 5

Sometimes people need to do risky things

The fact that some type of action is risky doesn't necessarily imply that this action is bad - sometimes people do need to things like that to achieve their goals.

For example, even if most uses of P2P clients are unwelcome, it may well be that some user does need to download a specific large dataset that is distributed through BitTorrent, and thus needs a P2P client; or that someone needs a specific version of some library from a 'non-trusted' source - perhaps even explicitly downloading exploit code to test the exposure of the system they're maintaining.

In such cases, it is reasonable to warn people and ask whether they're sure, HOWEVER, it that wasn't a mistake, and it wasn't an accident, they intended to do that thing while knowing the risks and taking care of them, redirecting them to training seems ridiculous - a course about potential risks of P2P is irrelevant if achieving a job goal requires a P2P client.

Perhaps the 'popup message' should rather say "This action is prohibited by policy, if you believe that this action is justified anyway, the proper process to get approval for an exception is described at XXXYYYZZZ" instead of patronizing talk about reasons for the policy, which aren't helpful to the user.

Answer 6

Yes people can see this as very intrusive and they might think you're judging them.

But unless these are almost all false alarms, it just proves that it is probably necessary. Nobody likes being in the wrong and nobody likes to admit that they have been scammed. People like to think that it can't happen to them because they are smart. That's why victims often don't report crimes. Yet everybody can become the victim of a scam, if the scammer is pushing the right buttons.

Make sure that any message you're sending to users is not accusing or shaming them and considers their privacy. But then also make sure that the message isn't easy to ignore and that it is actually very annoying. A mandatory and boring but on-subject seminar for repeat offenders is a very good punishment. Not because they necessarily will learn much from it, but because it is annoying and the user will therefore want to be cautious to avoid being forced to attend the seminar. There is a reason seminars for drivers that repeatedly break the rules are a thing (almost every driver will know that you're not supposed to break the speed limit or drive through a red light).

Make sure you prepare this as well as possible, that you communicate to the employees why you're doing this, and that you are backed by management. Then go ahead, but be prepared for people not liking it.

This is, of course, assuming the system isn't creating a lot of false alerts. A system that is constantly sending out false alerts can be a lot worse than doing nothing at all, because you're training users to ignore the alerts.

Answer 7

Allow me to address your example specifically. I understand why a company would block twitch. It's a distraction, a potential strain on resources, there's some NSFW content on there, and every non-essential network connection slightly increases your attack surface.

The coaching prompt mentioned none of that. It said you blocked twitch because some other streaming apps might have malware. It comes across as disingenuous, like you're coming up with excuses to block something that is harmless, and that you don't trust your users to distinguish between a highly popular and reputable streaming service and some sketchy app.

In my opinion, the problem is more with the messaging than the policy.

Answer 8

I think the problem here is that you're trying to automate something that should be a management job.

When someone does something that is against your security policy, you're giving them an automated reprimand and punishment. That could be seen as less serious than their boss doing it, but people react negatively because they don't think a robot should have that sort of power.

I think this would work much better if it alerted the line manager, who could talk to the employee, point out that they violated the company policy and could be fired - but will let them off (this time) if they do the training.

Nobody wants to feel that they are working for a robot.

Answer 9

Add some carrots

Other responses are already answering why your tool is not well received. This tool is all sticks and those are very personal.

I suggest to add a carrot: Provide a simple to access feedback channel in the process, where users can tell you, why they think it is safe.

Then do another PoC with that. You might find the responses surprising and you will probably whitelist one or the other page (or email sender) after that.

And the users are forced to express their reasoning, which requires a thought process: "Why is this nevertheless secure?" "Am I sure about this?"

Answer 10

What your users are realising is that you are monitoring them.

Even though your monitoring use case is relevant, your usage of users' data is proportional to the task you face, is aligned with the users' interests and is not used for other intents, your users might not know this.

The issue with surveillance is that it can be used for purposes that are against the users' interests. For instance monitoring time spent working or social network usage.

In particular some of your users, even though apparently not sufficiently trained security wise, are developers and should already be sensible to the surveillance argument.

All other answers focus on whether this is proportional or not, but the main issue is that your users did not know about this surveillance system and as such, and as can rationally be expected, do not trust it.

I would focus on increasing trust, with increased transparency. For instance by showing that the system does not monitor private usage of the net, or that the security team and management do not have access to usage logs except when warnings are triggered. I would also show the vendor website and documentation, to show users that no surveillance feature is being sold to management.