In an ideal world security controls should integrate seamlessly with business strategy and through policy and procedure support operations. In reality however security controls often disrupt operations. From a user perspective an Information Security Department is simply a group of people sitting behind computers all day saying “no” to everyone. Although that is sometimes the case (“no” is a common word in their vocabulary from what I have seen), there are reasons behind it. This week I want to share a story of how a change in policy and procedure by one security department, disrupted current operational workflow in another. Our AV engineering team works with integration vendors to build out the videoconferencing infrastructure through our offices. One day our director of security decided this vendor had too many badges assigned to them and wanted to reel back access to physical locations by limiting the badges to 2. The reasonin...