It has not been answered because no standards exist by which to determine whether systems are protected against common attacks and there are no standards for the skills of security people. Despite a June request by the federal Chief Information Officers Council that all federal CIOs find and eradicate the Top 10 threats, no substantial, broad-based action has begun. The price of delay can be high. One agency that dallied found some of its systems taken over and used to attack other systems within the agency. The agency forensics team found the attackers had used techniques on the Top 10 list to gain control.
Federal agencies are prime targets of attackers.
Establish a SWAT team to assist local system administrators in eradicating any of the top 10 flaws they find. Report monthly to the agency head on system status with graphic comparisons of divisional differences in security readiness. Require system administrators and security people to demonstrate their competence through testing and practical exercises. Adopt, monitor and enforce minimum operational security standards.