> It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Exactly this. I realized this

> It's almost as if, at some size, a company's "internal" network should be considered no more secure than the internet itself. Exactly this. I realized this a few years ago, at a previous employer. We had _excellent_ security at the firewall boundary. Inside the network gave me cause for concern. Once could plug into any port, in any building, get an IP address and ping anything on our network. And how good was site security at a given location? Who knew, really. When your server's security depends on J. Random Employee not allowing tail-gaters at the back door ... you got problems.