Me talking to a Helpdesk person being very precise in what they're telling me about an issue, instead of the whole picture of what they’re trying to accomplish because they think I will prevent it. I already know what they’re doing, but I don’t actually care as long as we have a process for it.
My reply:
The thing about Security is it’s doing procedures in a safe way, not preventing them. This is the benefit of practitioners in Security roles, alongside traditional policy folks.
Otherwise you just say no and people do it anyway. Which means you have lost control, not gained it. You have abdicated responsibility instead of directing action.
This goes for any kind of role where you're accountable for the bad side of something and are isolated from the actual core business productivity responsibilities.
Legal, HR, QA, sysadmins, change management, etc are all similar. If you habitually say "no" instead of coming up with ways to make people's work aware of your safety concerns, staff will work around you and your responsibilities instead of listening and working with you.
@Pxtl @SwiftOnSecurity I wish more organizations would realize this. I always think of the line from Star Wars, "the more you tighten your grip, Tarkin, the more star systems will slip through your fingers."
I have seen organizations with security rules that preclude some workers from using the tools they need to use for their core job functions, and, guess what, people circumvent the restrictions rather than just saying "well, you've made my job impossible" (in no small part because no one seems to be interested in hearing the latter anyway).
I've also seen people go through gymnastics of rationalization to avoid asking legal about something because they know that legal just reflexively says no to almost everything (unless someone very powerful asks about it). Ultimately, that dynamic does not work to the benefit of the organization.
