In some companies, it makes sense to follow a policy requiring that visitors be escorted from the lobby and from meeting to meeting. Procedures should require that the escort make clear when delivering the visitor to his first appointment that this person has entered the building as an employee or nonemployee. Why is this important? Because, as we've seen in earlier stories, an attacker will often pass himself off in one guise to the first person encountered, and as someone else to the next. It's too easy for an attacker to show up in the lobby, convince the receptionist that he has an appointment with, say, an engineer ... then be escorted to the engineer's office where he claims to be a rep from a company that wants to sell some product to the company ... and then, after the meeting with the engineer, he has free access to roam the building.