on Data transfer protection is mainly addressed through zonification, tunnelling and encryp- tion. Zonification is the determination of different boundaries between network segments called security zones. They usually correspond with natural boundaries observed in the network data flow or the network topology. The traffic flowing between different security zones is tunnelled using protocols like L2TP and L3TP. The tunnelling process encapsulates the TCP/UDP or the IP datagram providing special means of protection against spoofing (injection of hacker's IP packets in the data flow). The data can also be encrypted in the tunnel using IPsec. Before entering a security zone data contents of the traffic flow may be controlled at security inspection points. In these points there may be a firewall, a filtering router or even an IP security end-point aimed at control data integrity and privacy. The existence of security policies, covering not only IT security, but general corporate security is essential to assure the system integrity. Security violations frequently come from sources not usually taken into account, such as employees' information, trivial or unchanged passwords, and even physical security attacks. Security violation attempts have to be alarmed, reported and consistently analysed in order to prevent future damages. Integration between the telecom management alarm and performance management and the global security systems should be desirable although it is not always feasible. 16.9 QoS MANAGEMENT The rather crowded Figure 16.23 exemplifies some of the ongoing initiatives and con- troversy around QoS. Delay and jitter are annoying to the end user for multimedia synchronous (isochronous) services, like voice or video. The associated and necessary QoS management consists mainly of: Admission policy (possibly shaping). Assignation of specific paths for isochronous real time traffic (preventing the competi- tion from long IP data packets). Prioritization (certain packets can be dropped in case of congestion). The