Few legacy systems have simple, easily applied fixes. They normally require assessment, risk evaluation, development of solutions where appropriate, testing, and ongoing attention.

181

A large percentage—maybe all—of the identified security events could have been precluded by the appropriate application of currently available good practices and security technology.

125