There’s a ton of these pseudo-security measures bestowed upon us by various outdated security benchmarks, which we have to follow or risk losing our certificati

There’s a ton of these pseudo-security measures bestowed upon us by various outdated security benchmarks, which we have to follow or risk losing our certification or regulatory permissions, even though said measures in most cases reduce security. I’m looking at you - Sudoless single-user machine users - VPNs - AVs on servers - Disabled ports - Disabled ota protocols - etc