Based on the Ainsworth, are network security best practices only based on executing hardware and software solutions? If not, how can one of these network security best practices be customized to requrements or risks present in the organization? How are risks to particular organization discovered or established?