David Spark

David Travis, City of Auburn, posted a photo of the offending door lock to mock it and show how the blast radius expands when someone bypasses the control.

And it was just a photo of a lock and literally had the four-digit code printed right above the lock.

Now, that's the knee-jerk reaction, though, what David Travis said, of a security professional and understandable.

You know, at one time, that door did need to be locked.

But it's possible systems have changed.

That door doesn't need to be locked anymore.

If that's the case, honestly, it's far easier and cheaper to just post a code on top of the lock than finding a locksmith to remove the no longer needed lock.

So system design requires security professionals to walk in users' footsteps.

When do you ask, and I'll start with you, Rob, here, why is this control here?

And what risk is mitigated by having this control?

I mean, is this the regular process you go through to audit your security controls or do you do something else?

How do you handle it?

I was going to say, you were painting a picture there, David.

I could have started the segment, how do you review controls, Robin?

I mean... Like, what are the questions you... Like, here's a control.

What are we doing?

Like, why is this there?

Are we even noticing that the control is there?

Like, what is the conversation you're having?

But hold on.