> You probably need it because your corporate IT department wrote a policy that says you must have it. I think the causes are deeper. At the end of the thread

> You probably need it because your corporate IT department wrote a policy that says you must have it. I think the causes are deeper. At the end of the thread you will probably find some horribly outdated "best practices" and some big consulting firm that is paid $$$ to security-audit your company. The IT department are just the poor buggers that need to do whatever is needed to get that audit, although they may well know that much of it is theater.