>To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to

>To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer. This is crap =]. There's only 3 ways an attacker can get in. 1. Software Bug - 0-day exploits are only effective until the developer fixes the bad code (patch). 2. Configuration Drift - Attackers can only pop boxes that have drifted away from being updated or hardened. That's why they can only pop one of the boxes...not all the boxes. That's why you Recon more than Infiltrate. 3. Social Engineering - Why does the person who is easily susceptible to phishing have keys to the castle? All-the-time diligence (not point-in-time diligence) implemented on security controls is what's needed. Not more cyber-offense (e.g. Penetration Testing, Vulnerability Scanning, Risk Assessments)