 layered protection. Both methods will be used. 6.6 MAIN WAYS TO IMPLEMENT SECURITY 6.6.1 SECURITY POLICY IN A COMPANY Security policies are in conflict with user friendliness. The tighter the security, the less is the convenience to users. Users will therefore find a way around a policy if it's too difficult to comply with. Some general security advice: Understand how your system normally functions. Notice unusual events that can help you to catch intruders before they damage the system. Use auditing tools to detect unusual events. You should know exactly which software you rely on, and your security system should not have to rely upon the assumptions that all software is bug-free or that your firewall can prevent all attacks. Create appropriate barriers inside your system SO that if intruders access one part of the system, they do not automatically have access to the rest of the system. The security of a system is only as good as the weakest security level of any single host in the system. Passwords and encryption keys are secrets. The more secrets, the harder it will be to keep all of them. Security systems should be designed SO that only a limited number of secrets need to be kept. Security Physical access to a network link usually allows a person to tap that link or inject traffic into it. It makes no sense to install complicated software security measures when access to the hardware is not controlled. Administrators, programmers and users should consider the security implications of every change they make. Understanding security implications requires lateral think- ing and a willingness to explore every way in which a service could potentially be manipulated. Users must have access to qualified support to ensure accurate use of security systems. The security management and technical staff must work with the security solution on an everyday basis. Solutions for secure networks are not static. Education is important. 6.6.2 THE LAYERED VIEW Let us now look at the security of the network and services in a layer