They forbid us to add our ssh keys in some server machines, and force us to log in these servers with the non-personal admin account, with a password that is super easy to guess and haven't been changed in 5 years.

Access to change production systems was limited to a single team, which was tasked with doing all deploys by hand, for an engineering organisation of 50+ people. Quickly becoming overloaded, they limited deploy frequency to five deploys per day, organisation-wide.

Bit of a shit-show, that one.

The IT company I work for purchased me, along with some number of my coworkers and our product line from my former employer. Leading up to the cut over, we’re told that on midnight of the change, our company email will stop working. No forwarders or anything. BUT, we will get a new email that consists of gibberish@stupidsubdomain.company.com. When the password on this new account expires, because we can’t change it because we’re no longer employees, we have to go to a website to request a password change. This emails us a link to our new company email address, but we can’t use that link. We have to manually change part of the URL for it to work. I had them manually change my password twice before I gave up on the whole process. Figured I didn’t work for them anymore. What would they do if I stopped using this bogus account/email address, fire me?

Disabled "unnecessary" services on all member servers including netlogon. That was a fun couple of weeks.

I used to work with a guy who glued the USB ports shut on his labs. I asked him why he didn't just turn them off in BIOS and then lock BIOS behind a password and he just kinda shrugged. He wasn't security, but it's kinda related to your story.

¯\_(ツ)_/¯

Security where I work is pretty decent really, I don't recall them ever doing any dumb crazy stuff. There were some things that were unpopular with some people but they had good reasons that far outweighed any complaints.

SSL proxy, in a company full of developers, so they could sniff traffic. It broke everything. It's one of the reasons I left that company.

In high school they blocked dictionary.com for some reason.

I got to say after reading a couple stories here I can understand the frustrations and some very legitimate stories here make a lot of sense in the context of it teams fucking up. but I also think there's a lot of ignorance about what people are actually trying to accomplish in some of these stories as somebody that does it security and a lot of compliance work sometimes we're doing these things because we have to not so much that we want to.

Very short screensaver timeouts, useless proxy, short timeouts from intranet pages, disabled browser extensions, to make impossible to automatize our very repetitive work, daily DB access requests for work, etc.

Our IT mandated 15 character long passwords. Many people in manufacturing (the guys who make the stuff we produce or setup and fix the machines) have the passwords in the format: "Somename123456..." You get the picture. When the passwords are forced to change? Yeah, just add "a,b,c,d..." at the end. Many have it written down on some post-it note on the notebook or desk. Security my ass.

I wouldn't be surprised if I found that office guys have it too.

Mine refuses to use ipmi. Also all switches use the same password.