I can’t reply to the post directly (locked?) but my take is that security measures like VPNs and proxies are moot because tech isn’t really the vulnerability- people are. You can have MFA on everything and all databases behind VPNs, but if there’s a goddamn OneNote with all the DB passwords floating around… how do you keep that contained? How do you guarantee that an employee won’t take a password and put it somewhere public? It’s not practical to monitor me censor employees to that degree. A better approach, in this example, is to have the database set up so that when it is hacked into, no irreversible damage is done, and the data is worthless/unreadable to the hacker.

E; I can comment on the post now shrug