He says managers often assume security is being taken care of, while the rank and file assumes that if security were a priority, management would let employees know about it. Finally, agencies must make security part of daily existence. It must become a way of life. If agencies determine their risk, then create policies based on both risk and internal business processes, their technology requirements should be obvious. But it is never this easy.
Agencies already possess a conglomeration of policies and technologies.
Often, the technology strays from policy as systems are modified for various purposes. Effective security policy is like a chain. One bad link and you can be compromised very easily. Only a few years ago, agencies could simply control the few entry points to their networks. But today, there are too many of these to control.