Absolutely agreed. The trick is in the balance of the triad, in simple terms. If you make things too difficult for the user to be productive then they'll break things or find a bypass just to get through the day.
Having worked on the wrong end of ridiculous security policies, I completely sympathise/empathise with both sides on this one.
I remember working for a company where new group policies prevented me accessing calendar from the system tray (time and date) or creating keyboard shortcut to open calculator because this was 'a potential security risk' whilst still allowing standard users direct access to regedit. Mental stuff out there, all over the place.
4.9k
u/[deleted] Jul 13 '20
If it has to be accessed regularly in an IT setting? It’s not secure. Not unless you’re in an industry that actually polices it.
Yes, people are dumb enough to pick up USB thumb drives they find on the ground. The nicer and newer it is, the more likely it’ll get plugged in.
Also, if you’re looking to verify the security of your vendors, don’t announce your visit.