How to emphasize that downloads may be a malicious to users?

Question

These applications allow cyber security professionals to access files that are involved in reported malicious online incidents. This is the part of a larger service offering to these users. 99% of the time, users understand that they are reviewing malicious files which can have a security risk to their system and network.

An individual recently downloaded some content in a non-secure way and got their system infected and we have been asked to put an explicit warning for users.

Additional Details:

• There is no way of categorizing these particular downloads level of security risk. Some downloads may be malicious and others not.
• This is restricted access to security personnel.
• This won't be the actual text which will be provided later on to us.

Some initial concepts:

Option 1: Login Warning

Option 2: Clickthrough warning after login

Option 3: Passive warning on download

Option 4: Active warning on download (This is my preferred method)

I feel that I might need to use multiple ideas to get through the severity of the situation but I do not want to blind the 99% of the users who don't have any problem about using the site.

• Should the warning message be displayed every time the user logins or takes an action?
• Are there other concepts that I should be incorporating?
• Is it appropriate to include tips for downloading files safely (such as in a VM) since security can be perceived different from incident to incident?

Answer 1

There are two important things I could read through:

1) 99% users do not have trouble

2) Explicit warning message is needed

So considering both cases, you could go with Option 4, but additionally have a check box in the modal pop-up, that could say "I am aware of this. Do not show me this warning next time" or something of the likes. A regular user could hence make sure that next time he/she does not get the warning.

Additionally, it will be considered good to have a note somewhere in your home page stating the precautionary message.

Answer 2

What if, similar to option 3, whenever a user first enters the download area, a modal window pops over and the background area is blurred/darkened so it is not accessible. The modal window could contain your warning message along with a prominent "I understand the risks" button which clears the warning window and grants the user full access to the download area. After they exit the site, the warning "resets" and will be shown the next time they enter the downloads area, but only once per session.

Answer 3

The end user is a cyber security professional.

99% of times the end user is aware of the type of files they are about to download.

I would not make their lifes harder by having them to click two times: download>continue.

Idea with the checkbox not to repeat the question solves the problem of unnecessary two clicks, however you're loosing a chance to remind users about the potential danger when they go back to the platform next month. "Were the files from this part of the system safe to download or not?" - user may ask.

Option 3 - passive warning let's you both keep users informed all the time and not overkill them with accepting the warnings.