internal vs external security