Comment by betaby
It's a standard practice. And at $CURENT_JOB it's driven by semi-literate security folks, definitely not insurance.
It's a standard practice. And at $CURENT_JOB it's driven by semi-literate security folks, definitely not insurance.
As someone that happens to also be one of those clueless people when assuming DevOps roles in consulting projects, it is a very bad day when some clever user is responsible for a security breach.
A breach can turn out into enough money being lost, in credibility, canceled orders, or lawsuits, big enough to close shop, or having to fire those that thought security rules were dumb.
Also anyone with security officer title, in many countries has legal responsibilities when something goes wrong, so when they sign off software deliverables that go wrong, is their signature on the approval.
Insurance and liability concerns drive the security folks.
Just wait when more countries keep adopting cybersecurity laws for companies liabilities when software doesn't behave, like in any other engineering industry.