Yeah, it's pretty common. The network admins don't necessarily have security training, so they might not understand the reasoning behind the recommendations fr

Yeah, it's pretty common. The network admins don't necessarily have security training, so they might not understand the reasoning behind the recommendations from the security team. Ideally they'll work together, but most of the time our recommendations get ignored or implemented incorrectly. For example, after one test I performed on a Fortune 500 company, we recommended that they have separate VLANs for different parts of the company; employee workstations could connect to management interfaces on network hardware. The networking people just created separate subnets and called it good, even though every subnet could still talk to every other subnet.