understandable that an organization would keep its servers and other critical equipment in a secure room, but how far should companies go to protect other assets? For example, should workstations be secured to workers' desks by locking devices? Should software be locked away and "checked out" using a library-style system? How much physical security is enough? How much is too much?

2. Why don't more commercial operating systems meet the highest security requirements described in the Orange Book?