Five basic mistakes of security policy