Why are corporate IT policies the way they are?

I thought about this the other day when asking my IT department why they won’t let me carry a USB stick between home and work to be able to work from home and instead lock down the USB access and instruct me to use Google Drive instead…

I decided that most corporations only cosplay their IT security inasmuch as it only matters up to and not beyond the point of economic convenience.

If any of these companies truly cared about security, they would at the very least be using a hardened fork of Chrome with Google Services stripped out. They’d be self-hosting their own servers connected only via a VPN or some sort.

But that shit takes money and staff to maintain it. So they’ll give everything to third parties to manage instead and then send out pop-quiz emails about phishing every couple of weeks followed by sternly worded emails when a person fails it.

(Sorry…off my anti-depressants until pay day, so I have a lot of micro rants that have built up…haha)