I work for a software startup that has grown to about 30 people. Last month we had a "security week" where the entire engineering team worked on. As usual, we audited our own product and wrote some code to make things more secure. But we also found that our internal desktops were one of our biggest -- and most unprotected -- attack vectors.

In response to that, a couple of our engineers developed an IT policy for corporate computers. These are laid out as relatively straightforward requirements, like "you must not use IE 6", or "you must edit the registry and change the default timeout of the Beezlebop service."

These prescriptions were written up as corporate security policy, although employees are trusted and no one is policing it. If you have a legitimate business need to ignore a policy, like needing IE 6 around for testing, then no one's going to stop you. But be smart about it and don't use that browser to download warez.

I like the free and unrestricted nature of working for a startup, but I completely understand the rationale for these policies. Everything they recommended was due to known security holes and known vulnerabilities in default installations. It's irresponsible NOT to fix these holes. If our security was compromised because of a long-known Windows attack, it would make us look awfully stupid.