I know of company that did that as well. "We survived" is a very low standard. Security improvement should be measured against user impact and data being handl

I know of company that did that as well. "We survived" is a very low standard. Security improvement should be measured against user impact and data being handled. The org. in the article does not have data confidentiality requirements that warrant such a severe user impact. I know of first hand a corporation whose nationwide business would bw crippled by USB mass storage blanket ban. Context insensitivity is bad security.