>Perhaps you can ask for precise structure of databases. Then build your own test database(s). Then build test solution and let DBA eggheads
>'test it'. It will of course fail, but that will be not due to your fault, but due to complexity of security environment.
>
>Then you build another version.
>Then they test it again.
>Repeat 5-6 times till cooked to perfection :-)
>
>Bill them (Fast&) FURIOUS all along !!
>( Security comes at cost. We all know (and some agree) to that {g} )
>
>By the time they are both happy AND secure - you could become rich!

I'd happily bill the time wasted on going through security measures at a rate multiplied by at least two. In the places where I can get in two steps (establish VPN, then RDP or similar), it takes me just a minute to actually start working, no charge. In some places it's a several steps procedure - RDP to somewhere else because they don't like my IP, then use IE (aaargh!) to load their ActiveX connection client (mostly one per virtual machine, as these clients don't like each other), which is usually riddled with errors, incompatibilities, false messages and bla bla bla, then call to get a token, then the token expires so you call again, then discover that they have their national keyboard layout but the recognition of your own was lost somewhere along the way (does anyone here like AZERTY while not being French or Belgian?), then the FTP won't (from IE, but command line from CMD does, or... other ways).

In the end you get forced to use some other way to get the job done, and that way may be a serious security breach, but you keep your mouth shut because if they close that you can't do anything. And you have a contractual obligation. So if there's no "provide access" clause obliging them, you not only wasted hours and accomplished nothing, you actually risk losing money/customer/reputation.

In some places the users plead with contractors to help fight their own IT teams who take their security measures too seriously the TSA way. Everyone gets forced to do this and that so that these guys can justify their existence, while OTOH anyone physically present can stick a thumbdrive into any machine and walk away with oodles of data, which they don't care about.