With all due respect... I once saw a very authoritative explanation of abbreviations in the ISO2022 standard: they wanted to save space!

So banks of the world use Ccy fo Currency.

> I doubt this story is real, for whatever that's worth.

Plot twist: It's a social engineering test

Quite likely. Considering the "bugs" that exist in hardware which the security auditor has no control over which is a "forced to trust hardware" exercise, before even looking at software bugs, it seems like a job to keep someone occupied whilst most of the population drinks from the kool aid decanter.

> I doubt this story is real

Oh, never underestimate the incompetence of clients' compliance gremlins to mangle actual regulations into impossibly contradictory checklists and requirements.

That said, we have had trick security questions before too.

I've been told we'll fail a pci audit unless we go into the datacenter and replace all the blue cat5 with a different colour. Nothing is apparently too silly.

Can you tell us the full story?

That's pretty much the story. It came in as a high priority issue with no context. I asked for clarification, he asked if we wanted to fail the the audit. I changed them to red and he wrote a thing about we were more secure now.

I've worked in a datacenter that had a few different networks that must not touch each other. One of the precautions we took was color coded ethernet cables. A blue cable plugged into a red server will cause an incident if someone sees it; even if the other end is another red server 1U down.

Honestly, that seems clever, I like it!

This was a common practice in the military for secure and insecure feeds. I also saw this practice in telco.

Yeah you don't even have to get silly before you reach impossible.

One client's compliance jobsworth demanded a tour of our datacentre (AWS) to inspect physical security for low grade employee PII (email, name). I was younger and poorer then so bent over backwards to still get told "er, no thank you" from Amazon.

Client's security weren't happy with third party security certifications (of which AWS has most) so they reported up that we were likely hiding something devious. I think they'd had some sort of physical breach in the past but it just makes using an external service supplier untenable if you're going to treat security like it's 1970. I think we still got that contract but it took high-level meetings to ELI5 modern infrastructure's features and limitations.

We've had others rock up at third sales meetings (pretty advanced) saying they now "need" source and data design before they sign. One asked me to get a criminal record check. To reiterate, we're storing light employee data and everybody knows and understands that, but some people just seem to treat all data exchange as nuclear waste.

After hearing the phrase "encryption requires system administrator access" as the reason why there was no WPA2 network at my previous university for quite some time, this reads like many a true tale.