supported on firewalls. A firewall running as an application on a server may share the server with other functions such as DNS or mail, though generally, a firewall should restrict its activities to security-related tasks. Best Practices One of the things I tell my clients over and over is: Security is a balance between convenience and paranoia. We all want security. If I told you that I could guarantee the security of your family, wouldn't you jump at the chance? But what if I told you that to achieve this goal, I needed to put steel plates over all the windows in your home, replace the garage door with a brick wall, and change the front door for one made of cast iron? You might reconsider-it wouldn't be very convenient, would it? Companies also often want a high level of security, but like you, they may not be willing to give up too many con- veniences to achieve it. A while ago, I was working as a consultant in Manhattan for a large firm that was having security problems. We gave them some options that we knew had worked for other organizations, and these were the responses we received: One-time password key fobs "We don't want that-the key fobs are a pain, and it takes too long to log in." "We like the idea, but can you make it SO we don't have to enter any passwords?" Putting the email server inside the firewall "Will we have to enter more than one password? Because if we do, forget it." Password rotation "No way-we don't want to ever have to change our passwords!" Needless to say, the meeting was a bit of a challenge. The clients wanted security, and they got very excited when we said we could offer them the same level of net- work security that the big banks used. But the minute they realized what was involved in implementing that level of security, they balked-they balked at the idea of any inconvenience. More often than not, companies do come to an understanding that they need a cer- tain level of security, even if some conveniences must be sacrificed for its sake. Sadly, for many companies, this happens