> In my opinion, security needs to be the easiest path. Secure data handling can't ever be the easiest path. The easiest path is to have all data available all

> In my opinion, security needs to be the easiest path. Secure data handling can't ever be the easiest path. The easiest path is to have all data available all the time to everyone with zero access controls. Adding any kind of security to that is going to reduce the ease, even by a tiny amount. Security needs to be pragmatic, people have a job to do and a business to run. Security teams should never forget they are there to enable the business. But at the same time, the company needs to have a culture that recognizes data security is important. If that is not present, there's nothing the security team can do.