is only as good as the weakest security level of any single host in the system. Passwords and encryption keys are secrets. The more secrets, the harder it will be to keep all of them. Security systems should be designed SO that only a limited number of secrets need to be kept. Security Physical access to a network link usually allows a person to tap that link or inject traffic into it. It makes no sense to install complicated software security measures when access to the hardware is not controlled. Administrators, programmers and users should consider the security implications of every change they make. Understanding security implications requires lateral think- ing and a willingness to explore every way in which a service could potentially be manipulated. Users must have access to qualified support to ensure accurate use of security systems. The security management and technical staff must work with the security solution on an everyday basis. Solutions for secure networks are not static. Education is important. 6.6.2 THE LAYERED VIEW Let us now look at the security of the network and services in a layered way. The layering does not normally cater for the distribution dimension, but the view is very common. Security measures can be introduced at all levels in an IP stack. In Figure 6.12 a simple two-dimensional security view is provided. It is not possible to manage with protection at one single layer. A further protection measure, apart from access protection, is the partitioning of networks into zones. Figures 6.12 and 6.13 give examples of protection enablers at various layers. In Figure 6.12 the measures could be: For the application layer: encryption of transmitted user data, proxy filtering. For the network user: all types of access control to the network. See AAA below. For the control layer: control of individual and general security measures at the con- nectivity level, such as tunnelling. For the connectivity layer: tunnelling, filtering. Among the missing standards in Figure 6.13 are PGP (pretty good p