"Security policy should start by denying all access and then allowing access exceptions as needed."