Then again, a motivated defender is a very though adversary. Think "web server serves plain files only and is disconnected from the internal network"[1], "secur

Then again, a motivated defender is a very though adversary. Think "web server serves plain files only and is disconnected from the internal network"[1], "secure OSes everywhere"[2], "password quality checker installed"[3], "full-disk encryption for all serious data"[4], "SSH logins only via public key"[5], etc. Yes, this takes (some!) real effort. No, getting 0wned by "please drop the firewall and send me the root password" is not acceptable if you're a security outfit. Really, you can go years without patching if you choose your software properly. (Except browsers - those just suck.) [1] e.g. https://github.com/mojombo/jekyll https://github.com/mojombo/jekyll [2] e.g. http://www.openbsd.org http://www.openbsd.org [3] e.g. http://www.openwall.com/passwdqc/ http://www.openwall.com/passwdqc/ [4] http://www.openbsd.org/faq/faq14.html#RAID http://www.openbsd.org/faq/faq14.html#RAID or the equivalent for other OSes [5] All over the internet. Or set up a Kerberos environment and get single-sign on too.