Looks like this thread is still alive: http://serverfault.com/questions/293217/our-security-auditor...