Name:   MrHodja - Subject:   Hodja Date:   5/13/2021 9:19:05 AM

Not sure about the commercial side but Government systems problems come primarily from a lack of concern and unwillingness to exert the effort, or said differently "it is too hard, so if I ignore it maybe I won't get hit".  More and more they are forced to address it, though.  The Government uses NIST's Risk Management Framework, which is a systematic and very labor intensive approach to identifying what needs protection and setting about ensuring the system is configured to give it the best chance possible to thwart any attack.  While it keeps consultants like me employed, in my opinion it is not the best use of taxpayer dollars.  We should be spending more time, effort, and money on penetration testing, where "red teams" consisting of government employees and/or contractors actually go out and try to break into the systems, essentially doing the same thing hackers are doing.  That would identify the most likely vulnerabilities that hackers might attack and thus allow us to better focus remediation efforts and not waste taxpayer dollars on useless administrivia.