If you make security too onerous then people will just bypass it so they can do their jobs. We all know of people who write out passwords on postit notes as the

If you make security too onerous then people will just bypass it so they can do their jobs. We all know of people who write out passwords on postit notes as the password requirements make passwords impossible to remember. I also think power play often comes into security where IT invents or overstates risks just so they can lock down functionality to extend their influence.