Security guy here. I work in finance, but the calculus around how you look at risk doesn’t change much from industry to industry, what changes is risk tolerance

Security guy here. I work in finance, but the calculus around how you look at risk doesn’t change much from industry to industry, what changes is risk tolerance. Fact of the matter is that some things you don’t ever want remotely accessible. No security is perfect, and if your worst case scenario costs human lives, you simply cannot tolerate any level of risk. That being said, there are probably companies out there with security that poses more of a barrier to employees than it does protection to the organization. In those cases it’s important for orgs to do their own disaster planning (there are many scenarios where office become unavailable) and make appropriate plans to deal with that. Some orgs will not be able to function without an office depending on the nature of the work. Many can if they take the time to set up secure ways for people to work remotely beforehand.