Multi-pronged internal security policy needed