How should IT managers be involved in the security of their company's external services and products?