Based on the Ainsworth (2007) article, are network security best practices only based on implementing hardware and software solutions? If not, how can one of these network security best practices be customized to the needs or risks present in an organization? How are the risks to a particular organization discovered or established?