One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
A long time ago in a galaxy far away (before the internet was a normal thing to have) I provided over-the-phone support for a large and complex piece of software.
So, people would call up and you had to describe how they could do the thing they needed to do, and if that failed they would have to wait a few days until you went to the site to sort it in person.
The software we supported was not on the approved list for the company I worked for, so you couldn’t use it within the building where the phones were being answered.
I’m absolutely shocked that a company had a software whitelist before the widespread adoption of the internet. Ahead of their time in implementing, and fucking up, software whitelisting!
It was for government owned computers, they didn’t want any pirated or virus-infected stuff, and at that point there was no way to lock down such a mish-mash of systems.
The software company (who also do things like run prisons these days) had given permission for us to run the software and given a set of fake data so we could go through the motions when talking people through things, but apparently that wasn’t enough to get it on the list.