What is meant by the term "their security policies are flat"? I understand a network can be flat, but a flat security policy is a new concept to me. Please explain.