One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
I feel this. I increased complexity and length, and reduced change frequency to 120d. It worked really well with the staggered rollout. Shared passwords went down significantly, password tickets went to almost none (there’s always that ‘one’). Everything points to this being the right thing and the fact that NIST supports this was a win… until the the IT audit. The auditor wrote “the password policy changed from 8-length, moderate complexity, 90-day change frequency to 12-length, high complexity, 120-day change frequency” and the board went apeshit. It wasn’t an infraction or a “ding”, it was only a note. The written policy was, of course, changed to match the GPO, so the note was for the next auditor to know of the change. The auditor even mentioned how he was impressed with the modernity of our policy and how it should lead to a better posture. I was forced to change it back, even though I got buyin from CTO for the change. BS.
Having been exposed to those kinds of audits before that’s really just bad handling by the CTO and other higher ups!
Oh, I agree. Just one reason I decided to move on to a different employer.