I work for a company that deals with medical data, so we must comply with HIPAA as well as our desire for plain old corporate security. However, our ops team is quite zealous about the extent to which things are locked down. I don't need to give specific examples, I think, because that's not the point of the question, but the outcome is that it can be difficult to get things done without jumping through many hoops, and in a few rare cases, the security policies contradict each other in a way that some tasks are simply impossible. This is not "Security Theatre" because we actually do require some amount of security, which is in fact accomplished. A friend of mine I posed this question to put it quite well:
I know what you mean. Sometime security measures are so strict that they actively encourage people to subvert them to get what they need done and you end up with less visibility and control of what is being done.
Is there a term for this sort of over-zealous security that practically begs to be subverted? I don't want to discuss merits or otherwise of such policies, and again, it's not "Security Theatre" for reasons outlined above. I'm just curious if there is any generally accepted term for this because I'm coming up blank.