Sans.org: "Network security is not a product that you can purchase it's a process. A long process that you continually update, improve, and
monitor. A process that has a policy to define and guide as you manage risks, not avoid them. Starting the process is difficult. In fact,
you may not know where to start, what to do first, how to do it. You need to pace yourself but it's nice to have a guide. This paper is
such a guide."
December 13, 2001