A strong flow of information to and from the appropriate groups. The right people and the right tools to do the job. Sites do not install vendor patches for known security problems. Sites do not implement or enforce procedures and standards when installing new hosts on their network. Sites do not monitor or restrict network access to their internal hosts.
Sites still use antiquated authentication systems for remote access.
Sites do not dedicate sufficient resources to improve and maintain security. Network and system support personnel do not have management support or the authority to deploy appropriate security measures. Help recommend and develop internal security standards. Help define, produce, and maintain official security policy and documentation. Monitor, audit, and test systems and networks for possible security problems.