> In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly h

> In fact, standardising the IT approach through the EPA will might increase the risk since any vulnerabilities will be more likely to be standardised. Highly heterogeneous systems are expensive and difficult to cripple. This is not a safe assumption to make. As an example: Standardized patching programs are very basic and reduce a lot of this risk. Without them (or incentive/budget for them), it’s typical for most private and public orgs to end up with pretty bad security posture. This is a known failure state that results in many known vulnerabilities that can be trivially exploited, regardless of how heterogeneous these various networks are. Sadly, from what I’ve seen in the news and in various reports, I don’t think many regional organizations have the funding, expertise, or incentive to run effective security programs.