The ability to securely administer a network is a scarce skill that is not always understood or appreciated. The typical Federal systems administrator does not have the skills he or she needs. Attackers have a natural advantage. Attackers need only find one way into a system while the system administrator must find and block nearly all of the ways into their systems. Software exists that will automatically scan systems in order to find parts that are vulnerable.
Software continues to contain vulnerabilities.
Modern IT systems are extraordinarily complex and contain flaws that provide exploitable holes for attackers. Federal Web sites are high profile targets and in some ways are naturally vulnerable to attack. Agencies need to embrace the obvious solutions such as patching their systems with the current security patches, taking action consistent with security advisories, deploying virus detection tools, firewalls, intrusion detection software and vulnerability scanners. Agencies should test their own systems continuously. Agencies should configure their systems with security in mind.