A few years ago, I interviewed at a company called 'G Research' and the security procedures I noticed included:
* A 'secure zone' where work took place.
* All desktops virtualised, using thin clients.
* All Windows, no admin access.
* Screens, filesystem snapshots, and web access recorded, all the time.
* All software installation subject to approval (e.g. Firefox not permitted, only Chrome).
* Desks fixed in place, all cables in locked cable trays.
* Separate internal-only e-mail system.
* No printers.
* Specially printed notepads & other stationary in the 'secure zone', no secure zone stationary to leave or non-secure-zone stationary to enter.
* No cell phones, cameras or laptops permitted (lockers were provided).
* Entry points with human guards and metal detectors.
* No late working outside guards' hours.
While it would have been possible to get around the security if you were inventive enough (e.g. camera with no metal parts) it would be difficult to do so then believably claim it was an accident.
I didn't take the job, because I didn't feel I could be productive with so much bureaucracy.
