With a couple of phone calls and fifteen minutes of time, the attacker had gained access to the company's wide area network. This was a company that, like many, had what I refer to as candy security, after a description first used by two Bell Labs researchers, Steve Bellovin and Steven Cheswick. They described such security as "a hard crunchy shell with a soft chewy center"—like an M&M candy. The outer shell, the firewall, Bellovin and Cheswick argued, is not sufficient protection, because once an intruder is able to circumvent it, the internal computer systems have soft, chewy security. Most of the time, they are inadequately protected.