One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
There was a server I inherited from colleagues who resigned, mostly static HTML serving. I would occasionally do a
apt update && apt ugradeto keep nginx and so updated and installed certbot because IT told me that this static HTML site should be served via HTTPS, fair enough.Then I went on parental leave and someone blocked all outgoing internet access from the server. Now certbot can’t renew the certificate and I can’t run
apt. Then I got a ticket to update nginx and they told me to use SSH to copy the files needed.