Kafka’s Maxim: The people who write security rules and regulations don’t understand (1) what they are doing, or (2) how their policies drive actual security behaviors and misbehaviors. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory.