One chestnut from my history in lottery game development:
While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.
Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.
Paint the picture for management:
At one time surgery was the purview of medieval barbers. Yes, the same barbers that cut your hair. At the time there were procedures to intentionally cause people to bleed excessively and cutting holes the body to let the one of the “4 humors” out to make the patient well again. All of this humanity arrived at with tens of thousands of years of existence on Earth. Today we look at this as uninformed and barbaric. Yet we’re doing the IT Security equivalent of those medieval barber still today. We’re bleeding our users unnecessarily with complex frequent password rotation and other bad methods because that’s what was the standard at one time. What’s the modern medicine version of IT Security? NIST 800-63B is a good start. I’m happy to explain whats in there. Now, do we want to keep harming our users and wasting the company’s money on poor efficiency or do we want to embrace the lesson learned from that bad past?