I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security ap

I disagree with the GP’s approach of defunding education to improve education, but I’ve seen the culture that accretes from checklists and expensive security appliances. Everyone involved correctly comes to the conclusion that the company’s security policy is purely performative. The people that care leave. The people that don’t care about securing the system implement the useless checkboxes and put the standalone box in the correct room (and might even plug it in), then get promoted. FIPS security certifications are the poster child for this. There’s basically no way to get a securely architected system certified, so you end up adding vulnerabilities and (in the best case) a configuration parameter like the old “enable FIPS certification (default off; do not enable unless you are required to do so)” button from windows.