It's painfully hilarious to me how many glaring security holes are all throughout companies, but they will have the most asinine and pointless rules. They pret

It's painfully hilarious to me how many glaring security holes are all throughout companies, but they will have the most asinine and pointless rules. They pretend to follow PCI[1] in a few ways while breaking it in orders of magnitude more ways. Explaining this to them is a nightmare. I've seen so many post-its with login/pw just everywhere, unlocked machines, hints that were the password, one-word obvious dictionary passwords- but if you bring in a personal cell phone/book that's a serious and terminable offense! Side-note: the worst offenders kf post-its woth sensitive info are people with offices, like someone doesn't clean their offices every night (see further down). I once proved a point I could easily remember a complete CC# with all PII, walk out and write it down in the bathroom, yet still have rules saying you cant even bring so much as a book in with you. Which makes sense for following laws but not when you let random people walk in (HR, random favorite employees, whatever) with them even straight up notepads and pens. Someone could also easily walk in with a voice recorder on and just record all day and go home. So the rules did nothing practically, was probably more of a way to get rid of undesirables. All while the company is recording with ceiling-mounted cameras which went against their contracts (was to be visual only per compliance but wasn't), with public-facing IP without even a password(for the sole reason of wanting to make it easier to view the feeds from their cellphone), and hosted on a windows PC with Norton 360(PCI compliance after all!). Once someone high enough up is making stupid decisions they are defended mindlessly and to the death. Pointing out the reasoning behind the decisions and ways to reach those goals without just pretending to will always fall on deaf ears. Also many businesses seem to purposefully turn a blind eye to this[2], they do only enough KYC to CYA, etc. I've seen businesses follow PCI and recommended FTC best practices only to contract out their janitorial services, who then subcontracted to someone else. [1] https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security https://www.pcisecuritystandards.org/pci_security/maintainin... [2] https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business https://www.ftc.gov/tips-advice/business-center/guidance/sta... edited to add stuff