20

I manage a team in the cybersecurity division where I work. My team is responsible for owning several security tools used to protect company digital assets (Data loss protection suite - DLP, advanced end point protection, internet proxy software).

Several security incidents that resulted in business disruption over the past years were due to risky behavior of the end user such as successful phishing or downloading work related, but tainted, software from disreputable websites. Analysis of mock phishing exercises and audit logs revealed a pattern of the problematic users

In addition to continuing mock phishing exercises and blacklisting disreputable websites hosting tainted software, we have started a proof of concept (POC) of tools that will provide real time coaching to end users upon detection of risky behavior, such as:

  • Visiting P2P sites
  • Clicking external email links with forged addresses
  • Downloads of code libraries from non trusted hosting sources and potentially containing exploit code.

To give 2 examples of real time feedback being tested:

  • User A clicks on a Torrent P2P site or downloads a p2p file sharing client. Access to site and / or download is first blocked. In addition to the block message, KnowBe4 module would provide the user with customized feedback right then and there indicating why p2p sites are risky (e.g: backdoor shell programs allowing C/C , ransomware, unknown botnet participation etc.)

  • Developer downloads a code library from a disreputable hosting site and scan reveals exploit code / malicious executables. Another tool would first block download and then KnowBe4 would coach in real time.

The feedback from the small POC group of test employees (customer facing users and IT users such as developers chosen based on past patterns of user behavior) is mainly that the real time feedback seems too intrusive, big brother like, and creates distrust that end users are incapable of distinguishing safe from unsafe cyber behavior.

Senior management feedback is that POC results are very beneficial and they want to enhance the baseline security training cyber division provides all employees with the above described real time coaching functionality, and I / team agree.

  • Would you consider real time , automated feedback based on insecure cyber behavior to be intrusive or unreasonable?

  • How can our team mitigate the complaints from the POC while not going against what our division and senior management wants (if possible)?

Edit: Responding to comment to show how coaching works

For mock example, watch the video from KnowBe4 at 1:06 for what a coaching message may look when users go to Twitch TV to stream. The content of the security tip is fully customizable by us. To be clear, this is hypothetical only.

Edit: The examples I gave are not the only examples of risky behavior. E.g: Around end of Q1 each year, our DLP alerting software would go into overdrive, mostly caused by employees emailing their W2 and 1099 forms to themselves. To respond to comment as to what expected response is from end user, we have portal where these documents can be viewed and HR also mails hard copies in the mail for tax reporting purposes.

6
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on The Workplace Meta, or in The Workplace Chat. Comments continuing discussion may be removed.
    – Kilisi
    Sep 20 at 20:20
  • Are you sure the POC users are clear on the difference between the blocking and the inline delivery of training? I ask because it's easy to see how users might find the blocking intrusive. The training, not so much.
    – mjt
    Sep 21 at 14:47
  • 5
    @Anthony Given that most tax return are filed electronically, why can't your users have an electronic copy of their relevant forms? The way it currently reads still makes me think the users are trying to work around a broken system and that this is the root cause of your problem. Can you clarify? Sep 21 at 19:47
  • 4
    Does it distinguish between users going to Twitch to try to stream from their work PC vs. going to Twitch to put something on a second monitor? Even in legitimate cases (say, I've tried to download a virus) I'd find a bot berating me on Teams patronizing, and if it's a false positive to boot I'd probably be pounding the table. Sep 22 at 11:03
  • 1
    @MaciejStachowski if you are in a position where you need to stream on twitch you would probably be in a permission group that meant you didn't get the telling off. If you aren't in a position where you need to stream to twitch you are potentially exposing information that you shouldn't and most likely haven't had proper training anyway.
    – SeriousBri
    Sep 22 at 22:39

10 Answers 10

82

If folks have a better idea for a way to give employees the necessary training and help them catch the occasional mistake, that would be great. But all that has really changed is that they are being reminded to follow existing company policy.

If these are false alarms, you improve the tools to intrude less.

If these are genuine bad practices, the proper answer is "if you find it intrusive, you are doing things you shouldn't. Stop doing them and you won't find the tool intrusive. If you have a legitimate exceptional case, talk to us and we'll figure out how to handle it."

Unless you have an exceptional contract (or exceptional privacy laws that I don't believe are actually in effect anywhere), you have no reasonable expectation of privacy when using the company's network connections. The security team was already looking for use patterns that suggested a risk. All that's changed is that the end-users are being warned automatically... which is probably preferable to asking their managers to warn them.

No, the "annoy-o-tron" pestering isn't an ideal solution. Yes, it is distracting and sometimes inconvenient. But given today's computing security requirements, where paranoia may not be enough, this is actually a relatively low impact way to address legitimate concerns. Users will quickly learn what provokes these messages and find better ways to get their jobs done.

It does probably mean there are some personal computing tasks you can't do at work, at least not without supplying your own hardware and network connection. But given that most of us now have those resources with us at all times in the form of a smart phone, we do have alternatives.

If it gets in the way of legitimate business tasks... See first three paragraphs. And accept that security and convenience will never be completely comparable; the balance will always be evolving, and nobody will ever be completely happy.

3
  • Comments have been moved to chat; please do not continue the discussion here. Before posting a comment below this one, please review the purposes of comments. Comments that do not request clarification or suggest improvements usually belong as an answer, on The Workplace Meta, or in The Workplace Chat. Comments continuing discussion may be removed.
    – Kilisi
    Sep 21 at 23:27
  • 2
    "No, the "annoy-o-tron" pestering isn't an ideal solution." I think we should separate the "annoy-o-tron" from the actual blocking of risky behaviors. Obviously, you need to block employees from downloading trojans from sketchy websites. But is giving them a Dennis Nedry "ah ah aaah" on top of that actually useful? Do the employees honestly not understand what they are doing is risky? Or do most of them just think they can get away with taking a shortcut? Blocking is a technical safeguard. Annoy-o-tron is an educational tool. And I'm not personally convinced it's a good one. Sep 23 at 23:04
  • 2
    Yes, telling people why they are being blocked and what they should be considering instead is helpful. If they have a learning curve, they see the message only once or twice;.harmless at worst. If they can't learn, pestering us the least they should expect.
    – keshlam
    Sep 24 at 4:35
64

I'd be looking at the systemic reasons why your developers are having to use P2P sites or disreputable code libraries!

The problem with this kind of pestering is that people eventually tune out, if the systems within which they work cause them to encounter the pester repeatedly, if the usual correct response is to press on past the warning, and if it's practically impossible to discern the circumstances in which they shouldn't press on.

It's like a farmer handling haystacks getting an occasional warning that some may contain needles. Without even knowing whether one or more needles is present in any particular haystack, how exactly is he to react? He has a hundred haystacks to shift that day, how long is he to spend searching? Or does he just stop moving haystacks and wind up the business?

There's a strong tendency amongst IT professionals to promote the narrative that users are simply careless when it comes to cybersecurity.

In reality, detecting cybersecurity risks is an expert task (because there are world experts applied to the task of creating those risks in the first place), and even experienced professionals cannot do it consistently.

This is in the same way that no reasonable amount of human labour alone can consistently find needles in haystacks (and only allocating a minority with extreme patience and perceptual skills, and taking an extreme amount of working time, would hope to find even some of the needles).

Your end-users may phrase their problem with your scheme as indicating a lack of trust in their ability to discern safe and unsafe online behaviours. What they are probably meaning to say, is that your scheme indicates a lack of trust in their conscientiousness, and this scheme emanates from that lack of trust, rather than from a serious analysis of the difficulties.

You are the farm-master putting signs all over the walls, telling the hands to look out for needles in the haystacks.

15
  • 44
    @Anthony, what exactly would you expect them to do with the W2 instead of mailing it to themselves?
    – Steve
    Sep 20 at 14:09
  • 12
    @seg And if they spend that extra time on security, are you going to feed that back into their annual report? Is their manager going to care? Or are those going to reflect the things related to their primary role they did with the time instead? Whats their incentive to put the time and effort in? Look at why people are doing this, and make it easier to do it the correct way, especially re P2P and hosting sites. Sep 20 at 15:36
  • 12
    @seg, the problem is that attention isn't an infinite resource. Needles in haystacks can be stopped in theory by attention, there's no doubt about it. They cannot however be stopped in practice, because the amount of attention required far exceeds that which is reasonably available. This isn't a safety rope - it doesn't arrest any fall. It's a plaque telling professional climbers whose employer provides no safety ropes, that climbing these rocks may lead to falls.
    – Steve
    Sep 20 at 16:24
  • 13
    this answer is quite important. Control games are a downward spiral as people tune out or actively resist. No matter the intention, if people feel like these tools are a control game, then that is what they feel.
    – Mike M
    Sep 20 at 17:15
  • 15
    Classic real life example: My employer used to slap a warning message on every single email that came from outside the organisation I work for. Which was like 90+% of everyone's inbox, because most internal communication is/was not via email. The cybersecurity team almost by construction mainly dealt with internal communication, so it never occurred to them that the people who work there don't. I get the feeling the OP is operating under a similar misunderstanding..... Sep 21 at 12:02
32

I think a lot of the issues people have with systems like this is that the focus is completely backwards. Most people see IT departments as focused on identifying and protecting against external threats. They maintain firewalls to keep threats out, they analyze logs to identify new threats, and they scan incoming email to filter out malicious content. You are creating a shield to keep external bad actors out so that employees can work in peace.

From a user's point of view, the system that you describe has the business end pointed in the other direction. It's not monitoring for external threats, it's monitoring the people that you're supposed to be protecting. That naturally makes people feel like you're lumping them into that same category of threats that you're normally protecting against. Yesterday you were part of the company, under IT's umbrella of protection. Today, IT booted you out from that umbrella and now has to protect the company against you.

Take your second example for instance. Your system "coaches" the developer after downloading a library from a shady site. The user's expectation was that they might get a message saying something like "This download has been blocked because malicious content was detected. Access to this website will be restricted until IT Security can review the trustworthiness of this site", where the focus is on the external threat. Instead, they get a message like "You messed up. Here's what you need to do differently to avoid harming the company". In the first instance you're protecting the user against an external threat. In the second case, you're saying that the user is the threat and you're acting against them to protect the company. It's inherently antagonistic, and it feels shocking coming from a group that has until now been on your side.

A lot of the "intrusive-feeling" aspect of this particular system is the way it delivers these coaching messages. Instead of getting a "resource blocked" message in the web browser, you get an email or IM with a "coaching" message. These are personal and directed forms of communication. You're not putting up a wall blocking all traffic to a malicious site, you're watching my specific behavior individually and then sending "I saw what you just did" messages as soon as I do something that you don't like. That's really creepy, particularly if the messages are sent almost immediately. Even in an environment with no expectation of privacy, and even if you're not doing anything wrong, nobody's comfortable when they feel like the IT police are hiding in the bushes with binoculars, watching and recording everything they do.

As a simpler example, I drove through a construction zone the other day that had a temporarily-reduced speed limit. The "construction zone" sign had a speed sensor and a screen on it that would display how fast you were going. If you exceeded the new speed limit, the screen would flash "SLOW DOWN". Imagine instead that it was just a plain wooden sign and after you drive past, your phone rings and a voice on the other end says "you're driving 10 mph over the speed limit, you should really slow down *click*". Both systems accomplish the same thing, but the second one does it in such an intrusive and personal way that people will be extremely uncomfortable with it.

Any system you implement will not be successful without buy-in from those using it. This kind of feedback should be a clue that however useful you think it will be, users will fight it and do what they can to work around it. Instead, you should be able to get most of the benefits without creating an uncomfortable or antagonistic environment. First, keep the focus on the external threats. Your messaging should not be "you created a security risk", it should be "a security risk was detected and has been blocked". The underlying action was the same but the tone is neutral and impersonal. Instead of singling out people after they've done something wrong, make sure everybody in the company is getting annual security training and verify that they've learned the important concepts. Hold periodic 5-10 minute refresher courses where you talk about the specific types of incidents that your systems have detected and what can be done to avoid them. Not only would people not feel like they're singled out for surveillance, but you'd be educating the rest of the company before they make a mistake. You're much more likely to get employee buy-in from something like that. Singling out individual users should be reserved for those with particularly egregious or frequent mistakes, and even then it should be done via a conversation with an actual human, not a message from the IT surveillance bot.

6
  • 7
    Unfortunately, no threat detection system is going to be bulletproof, so if people keep clicking on phishing links, there will inevitably be a time when the monitoring fails to step in and prevent disaster. "We have detected a risk and blocked it" does not really communicate what it needs to, "you just did something really dumb, but fortunately, our safety net managed to save you this time, the company might not be so lucky next time". It's extremely dangerous to teach people that something else is watching out for the risks so they can be careless.
    – TooTea
    Sep 21 at 10:26
  • 5
    @TooTea, I don't agree. The tenet that prevails over your thinking is that the user is the final line of defence, and that there's something possible to do which they mustn't do, and which they know they mustn't do, but which is nevertheless undetectable to any monitoring tool. That's completely the wrong way to think about these things. If a tool cannot reliably detect the error, then the average user cannot reliably avoid the error.
    – Steve
    Sep 21 at 14:17
  • 3
    @Steve I'm all for using five tool-based layers of defence in addition to the common sense of the user. I doubt any amount of tools can replace human reasoning completely. If you get a (spear-)phishing email supposedly from your officemate and lifelong friend Jack which starts with "Dear Mr. Smith", any sane person will immediately know something fishy is going on, but the tools will never realize this is not how Jack would ever address you.
    – TooTea
    Sep 21 at 16:05
  • 1
    @TooTea, in your example, what makes the difference is not merely "human reasoning", it is a separate source of information about Jack's usual manner and character, and a level of inconsistency that is presumed obvious. Fwiw, my best friend occasionally does address me irreverently as "Mr Smith". I don't think it's reasonable to rely on people to know intimately others' written communication style at work (and for crooks not to know or guess that style sufficiently), as an actual cybersecurity measure.
    – Steve
    Sep 21 at 17:24
  • 2
    Another potential problem is users developing the view that the IT department understands their role as covering their own asses as much as possible, not assisting the rest of the organization in achieving their goals.
    – llama
    Sep 22 at 15:29
17

the real time feedback seems too intrusive, big brother like, and creates distrust that end users are incapable of distinguishing safe from unsafe cyber behavior.

I'm not familiar with the specifics of this product, but how intrusive is this really, and is there anything you do can do make this less intrusive? Is it just a popup that they can immediately close, or is it something more persistent and disruptive to their workflow? If they're customer-facing, is it having causing issues while they're dealing with customers? Can you get any feedback from them about what specifically they find so intrusive, and what they would consider acceptable?

Senior management feedback is that POC results are very beneficial and they want to enhance the baseline security training cyber division provides all employees with the above described real time coaching functionality, and I / team agree.

What is this view based on? Do they have actual data to demonstrate that this real-time coaching has reduced the number of security incidents, compared to these actions just being blocked? That it has resulted in a meaningful and measurable change in behaviour?

If you have real evidence that this approach works, then you have a much stronger argument for why rolling it out further, and can make that argument to your staff. But this is just management feeling like it's very beneficial without any actual evidence then you're going to struggle to convince people, as it will sound like management just jumping on the latest trendy bandwagon.

The feedback from the small POC group of test employees (customer facing users and IT users such as developers
[..]
Senior management feedback is that POC results are very beneficial

It may not be a coincidence that the people who are in favour of it are not the ones who it's being applied to, and the people who it's being applied to are not the ones in favour of it.

Roll it out to all the senior managers who think it's "very beneficial" for a few weeks or months, and see if they still give the same positive feedback.

And if after a few months you can say "We've extended the pilot to the management team, they're all still in favour of it, it's led to a $percent reduction in security incidents, which has saved $time and $money" then that's a pretty strong argument, and it sounds like a good idea to deploy it more widely.

And if you're not able to say that after a few months, then perhaps you need to reconsider whether this solution is really as good as you think it is.


And as a wider issue, you need to have a serious look at the shadow IT in your organisation. If your users are torrenting stuff, accessing P2P sites and downloading random libraries/binaries/etc then you need to look into why they feel the need to do this - because none of those should be happening in a professional environment.

2
  • 14
    Roll it out to all the senior managers That's a great idea ... that won't work at all. The senior managers won't be doing any downloading of any kind, so they'll never see the warnings and will thus just say "well I've got it and it never intrudes upon me at all". It would be like saying "we rolled out the 20-page sign-in-sign-out form for pick-axes and shovels to include the mine owners as well, and they didn't find that it wasted any of their time at all".
    – Brondahl
    Sep 20 at 13:51
  • 23
    @Brondahl Falling for phishing emails, downloading and running dodgy programs and "Clicking external email links with forged addresses" sounds like exactly the kind of things that senior managers do. As do some of the new things that OP has added in their edits, like emailing personal information or watching streaming videos online.
    – Gh0stFish
    Sep 20 at 13:55
11

Sometimes people need to do risky things

The fact that some type of action is risky doesn't necessarily imply that this action is bad - sometimes people do need to things like that to achieve their goals.

For example, even if most uses of P2P clients are unwelcome, it may well be that some user does need to download a specific large dataset that is distributed through BitTorrent, and thus needs a P2P client; or that someone needs a specific version of some library from a 'non-trusted' source - perhaps even explicitly downloading exploit code to test the exposure of the system they're maintaining.

In such cases, it is reasonable to warn people and ask whether they're sure, HOWEVER, it that wasn't a mistake, and it wasn't an accident, they intended to do that thing while knowing the risks and taking care of them, redirecting them to training seems ridiculous - a course about potential risks of P2P is irrelevant if achieving a job goal requires a P2P client.

Perhaps the 'popup message' should rather say "This action is prohibited by policy, if you believe that this action is justified anyway, the proper process to get approval for an exception is described at XXXYYYZZZ" instead of patronizing talk about reasons for the policy, which aren't helpful to the user.

7
  • I disagree slightly. Some people are bent out of shape when the message tells them something obvious, some people are bent out of shape when the message doesn't explain the rationalle. You really can't win on that front, and the amount of support time wasted is probably lower with the explanation than without it. And in any case, if the user sees this message more than RARELY, they aren't showing evidence that they understand...
    – keshlam
    Sep 21 at 13:54
  • 1
    @keshlam "if the user sees this message more than RARELY, they aren't showing evidence that they understand..." no, that demonstrates that there is a disagreement between the user and the automated trigger, but it can also be a systematic false positive, falsely triggering every time when the user does something they legitimately need to do every day.
    – Peteris
    Sep 21 at 14:27
  • See first few paragraphs, @peteris. If that's the case, make SPECIFIC suggestions and discuss improvements and/or alternatives. No policy works 100% of the time; reality is fractal .. but that doesn't invalidate these of policy as a starting point that handles almost all cases.
    – keshlam
    Sep 21 at 16:50
  • 1
    @keshlam I'd sugges to (1) acknowledge that in phishing prevention there's a tradeoff between security and usability and the security team must balance those; (2) from what OP posted, it seems that they're over the optimum of that tradeoff and they need to work on improving usability, and figure out how to do that at a minimum cost to security, not vice versa; (3) also, since phishing can be reduced but not eliminated (neither these tools nor training will stop a good spearphish), so they should instead focus on the (many!) technical means to reduce the consequences of a successful phish.
    – Peteris
    Sep 21 at 18:11
  • 1
    Unfortunately, I don't believe things can be separated and prioritized/ordered that cleanly. This needs to be something of a full-court press, I think. But I do see your argument.
    – keshlam
    Sep 22 at 15:29
6

Yes people can see this as very intrusive and they might think you're judging them.

But unless these are almost all false alarms, it just proves that it is probably necessary. Nobody likes being in the wrong and nobody likes to admit that they have been scammed. People like to think that it can't happen to them because they are smart. That's why victims often don't report crimes. Yet everybody can become the victim of a scam, if the scammer is pushing the right buttons.

Make sure that any message you're sending to users is not accusing or shaming them and considers their privacy. But then also make sure that the message isn't easy to ignore and that it is actually very annoying. A mandatory and boring but on-subject seminar for repeat offenders is a very good punishment. Not because they necessarily will learn much from it, but because it is annoying and the user will therefore want to be cautious to avoid being forced to attend the seminar. There is a reason seminars for drivers that repeatedly break the rules are a thing (almost every driver will know that you're not supposed to break the speed limit or drive through a red light).

Make sure you prepare this as well as possible, that you communicate to the employees why you're doing this, and that you are backed by management. Then go ahead, but be prepared for people not liking it.

This is, of course, assuming the system isn't creating a lot of false alerts. A system that is constantly sending out false alerts can be a lot worse than doing nothing at all, because you're training users to ignore the alerts.

2

Allow me to address your example specifically. I understand why a company would block twitch. It's a distraction, a potential strain on resources, there's some NSFW content on there, and every non-essential network connection slightly increases your attack surface.

The coaching prompt mentioned none of that. It said you blocked twitch because some other streaming apps might have malware. It comes across as disingenuous, like you're coming up with excuses to block something that is harmless, and that you don't trust your users to distinguish between a highly popular and reputable streaming service and some sketchy app.

In my opinion, the problem is more with the messaging than the policy.

1

I think the problem here is that you're trying to automate something that should be a management job.

When someone does something that is against your security policy, you're giving them an automated reprimand and punishment. That could be seen as less serious than their boss doing it, but people react negatively because they don't think a robot should have that sort of power.

I think this would work much better if it alerted the line manager, who could talk to the employee, point out that they violated the company policy and could be fired - but will let them off (this time) if they do the training.

Nobody wants to feel that they are working for a robot.

2
  • This might be me, but I would totally prefer getting that feedback and it not notifying my manager. But I appreciate others may feel differently. Sep 22 at 11:09
  • @mattfreake - me too, but some people would just see an automated message as an annoyance to work around. Also, the line manager is probably the reason they feel they need to download stuff in the first place. Sep 23 at 15:21
1

Add some carrots

Other responses are already answering why your tool is not well received. This tool is all sticks and those are very personal.

I suggest to add a carrot: Provide a simple to access feedback channel in the process, where users can tell you, why they think it is safe.

Then do another PoC with that. You might find the responses surprising and you will probably whitelist one or the other page (or email sender) after that.

And the users are forced to express their reasoning, which requires a thought process: "Why is this nevertheless secure?" "Am I sure about this?"

1

What your users are realising is that you are monitoring them.

Even though your monitoring use case is relevant, your usage of users' data is proportional to the task you face, is aligned with the users' interests and is not used for other intents, your users might not know this.

The issue with surveillance is that it can be used for purposes that are against the users' interests. For instance monitoring time spent working or social network usage.

In particular some of your users, even though apparently not sufficiently trained security wise, are developers and should already be sensible to the surveillance argument.

All other answers focus on whether this is proportional or not, but the main issue is that your users did not know about this surveillance system and as such, and as can rationally be expected, do not trust it.

I would focus on increasing trust, with increased transparency. For instance by showing that the system does not monitor private usage of the net, or that the security team and management do not have access to usage logs except when warnings are triggered. I would also show the vendor website and documentation, to show users that no surveillance feature is being sold to management.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .