One crack in any connected system is enough to let everyone else in. The members of the private sector designed and now own and operate NII, and only they have the knowledge to correct their unique vulnerabilities. Successfully patching the vulnerabilities in all the connected systems is useful but still insufficient. They must examine each new technical concept, before fielding if possible, and continue probing for faults throughout the life cycle, as each technical generation arrives with its own unique vulnerabilities. Red Teams can never ignore the painful reality that the threat is still the insider.
Security remains more of a people problem than a technical one.
Red Teams also contribute to deterrence because their activities measurably raise the bar of uncertainty for those who must calculate the probability of success of an attack on information systems. Having said that, a Red Team will fail unless it operates independently from line management or is visibly supported by attitude and actions of top management, or unless it is successful in its fault-finding efforts that result in praise, not punishment. This is not an add-on task for the inspector general or the operational test and evaluation folks. An aggressive self-defense program must be supported by both federal and industrial research and development. Surely adequate defenses are a critical element if that revolution is to succeed.