No network can be rendered impenetrable through access
control alone. Networks should ideally demonstrate an absence
of reaction to malicious access [52]. The system itself should
therefore be configured to minimise the effects of malicious
access to the system. Unused ports on switches and routers
should be disabled, as should data access capabilities of USB
ports on computers within the network. User accounts and
passwords should also be in place on all the equipment, to
prevent unauthorised operation of the device should either
physical or electronic access to it be gained. Software installed
on devices should be kept up-to-date and operating systems
should be patched to mitigate vulnerabilities. Such actions
are often referred to as ‘hardening’ the equipment. Access
control and boundary security mechanisms such as firewalls
are also not as effective at countering insider threats, i.e.
authorised persons acting in malicious ways. This threat is
best dealt with by organisational means, like clearly delimiting
employee responsibility, auditing and logs of actions and other
organisational security measures.