As a current IT exec in banking, a thing that keeps me up at night is the “go to” strategy of compromising employees’ ability to use productivity tools for “security”.

If you follow the lock-it-down strategy to the max, you eventually unplug the computer and keep it in a vault. Since you wouldn’t do that, that means you recognize that security can’t be at the expense of all utility.

So what is the right amount of utility to sacrifice in order to achieve security?

I’d argue — try for none. Make infosec the happy path.