s. The following sections describe the available security mechanisms, including firewalls; authentication, authorization, and accounting (AAA); encryption; and digital certificates. Firewalls A firewall is typically defined as a system or a group of systems that enforces and acts as a control policy between two networks. It can also be defined as a mecha- nism used to protect a trusted network from an untrusted network-usually while still allowing traffic between the two. All traffic from inside to outside and versa must pass through the firewall. Only authorized traffic, as defined by the local security policy, is allowed to pass through it. The system itself is highly resis- tant to penetration. A firewall selectively permits or denies network traffic. There are several variations of firewalls, including the following: A firewall can use different protocols to separate Internet servers from inter- nal servers. Routers can be programmed to define what protocols at the application, network, or transport layer can come in and out of the router-so the router is basically acting as a packet filter. Proxy servers can separate the internal network users and services from the public Internet. Additional functions can be included via proxy servers, including address translation, caching, encryption, and virus filtering. Viruses The term virus broadly refers to a program designed to interfere with computers' normal operations. The term also can be used more narrowly to refer to malicious software pro- grams that move from one file to another and can be transmitted to other PCs via an infected file. They generally don't seek out the Internet or e-mail to spread. Another type of malware is a worm. Worms make use of a LAN or the Internet (espe- cially via e-mail) to replicate and forward themselves to new users. Many worms target humans, not software. Finally, a Trojan horse hides within another program or file and then becomes active when someone opens the unwitting host. A big part of administrating security involves redu