Security is critical – no network engineer disputes that. Protecting data, devices, and users is part of our daily responsibility. However, there is a line where security controls, policies, and bureaucratic approvals become counterproductive, especially when they impede the very operations they aim to protect.

The Balance Between Security and Operations

Every security measure introduces overhead. This is normal and acceptable when the risk is justified. But too often, security policies are implemented without understanding their operational impact. For network engineering teams, this can manifest in several ways:

1. Approval Bottlenecks
   Engineers needing to deploy urgent changes – such as firewall rule updates, access point reconfigurations, or routing adjustments – are delayed for days or weeks waiting for security approvals. Meanwhile, business-critical applications remain down or degraded.
2. Overly Restrictive Controls
   Blanket security policies (e.g. blocking all non-standard ports or disabling administrative protocols without operational alternatives) may stop theoretical risks but break real services. Engineers are left scrambling to find workarounds, often compromising stability.
3. Change Windows That Don’t Reflect Reality
   Some organizations only permit network changes during short windows, combined with lengthy security risk assessments. This approach ignores the agile nature of modern businesses that demand continuous improvement, new services, and rapid incident resolution.
4. Security Without Context
   Security teams sometimes design controls without engaging network engineers who understand the technical nuances. For example, mandating encrypted management protocols across legacy gear that does not support them may force unnecessary forklift upgrades, costing millions and delaying projects.
5. Security as an Obstacle, Not an Enabler
   Ultimately, security’s role is to enable safe business operations, not act as a gatekeeper for the sake of enforcing rules. When policies are rigid with no path to expedited exceptions for justified needs, they undermine trust between security and engineering teams.

Wireless networks are a prime example of this conflict. When security teams do not understand wireless design principles – such as proper AP placement, roaming requirements, and the impact of excessive security layers on RF performance – they often impose blanket policies that degrade user experience or break connectivity altogether. Without collaboration and a foundational understanding of wireless engineering, security controls can unintentionally cripple the very mobility and flexibility that wireless networks are deployed to provide.

For example, instead of security teams stating “no APs in offices or near windows” as a blanket policy to reduce external signal leakage, a better approach would be enabling WPA3-Enterprise, WPA3 SAE, or Opportunistic Wireless Encryption (OWE) to ensure strong encryption and authentication regardless of placement.

Additionally, forcing APs only into hallways rather than offices or conference rooms “technically” doesn’t make a difference, as an attacker with a high-gain Yagi antenna parked outside the building can pick up RF signals leaking from hallway-mounted APs through exterior walls.

Finding the Middle Ground

To prevent security from hindering business operations:

Involve Engineers Early – Security teams should partner with network engineers during policy design to understand operational realities.
Risk-Based Approach – Evaluate controls based on actual business risk, not theoretical worst-case scenarios alone.
Streamlined Approvals – Implement clear, fast-track approval processes for low-risk routine changes.
Empower Teams – Train and trust engineers to implement security best practices without micromanagement on every command entered.
Continuous Feedback Loops – Hold regular security and engineering alignment meetings to review pain points and refine policies.

---

Final Thoughts

Security is non-negotiable, but it should enable the business, not block it. Network engineers want to build secure networks – we are on the same team as security professionals. The key is finding practical policies that protect without paralyzing operations. Only then can security fulfill its true purpose: safeguarding the organization while allowing it to thrive.