Over the last twenty or so years I’ve been a part of a lot of different environments. Companies as small as three people, to one of the world’s largest and most complex enterprises – all unique in their own way. The way they each handled security was fairly unique as well. Beyond the obvious “Did they take it seriously?” question, was the all important question of how they achieved balance. The type of balance I’m referring to was between flexibility and security. Organizations that figure out the balance flourished, while those who failed struggled.
For the record, I do not believe you can’t have both flexibility and security. I do believe, however, that you must compromise. Absolute flexibility, or absolute security, while they may appear appealing are ultimately bad. When you think about it, completely secure environments are often unusable. A similar thing can be said about complete flexibility. Those types of environments are virtually impossible to secure.
