Inside HQ: dumb terminal PC's (not laptops) using latest Windows* with all the patches, monitoring and BigBrother tracking of activity. All input ports (USB, li

Inside HQ: dumb terminal PC's (not laptops) using latest Windows* with all the patches, monitoring and BigBrother tracking of activity. All input ports (USB, lightning, whatever) on the PC are disabled, except for mouse/keyboard. Probably a pretty complex network topology where specific Ethernet ports/terminals have access to specific networks/applications for the most sensitive things. MAC address from the NIC is part of the authentication in addition to user login/2FA. Physical security to those rooms with keycard plus biometric access. Apply this concept to varying degrees appropriately for each system/team/room. Similarly complex application permissions/security would be needed as well. * Why Windows? PCs are cheap, after all this is the government we're dealing with here. If they are dumb terminals to apps then they are even cheaper when ordering thousands of them. And the gov wants easy support/training so Linux is likely a non-starter with non-tech people. They're not going to spend $1200+ on Apple laptops per person either.