It's hard to describe the extent to which no one is even trying outside of Silicon Valley and very large corporations. You guys have actual graybeard sysadmins

It's hard to describe the extent to which no one is even trying outside of Silicon Valley and very large corporations. You guys have actual graybeard sysadmins. There are actually people who understand security research and exploit development on your staffs. Even if they don't have the power they need, someone in the room is sufficiently paranoid to at least want to practice better security. Come to the Midwest sometime. It's dark out here. For starters, it's all Windows Server all the time - not even by choice, but just because nothing else ever occurred to anyone. No one has more than played with Linux at home. Security consists of buying magical appliances and antivirus software (from your VAR's salesperson on a site visit, through your VAR, through their distributors, through their distributors), and that's if you're lucky. "Security consulting" and PCI auditing consists of selling Nessus scans (again, if you're lucky, more likely some no-name proprietary tool) at $100,000 a pop. You're lucky if the Network Admin has ever even heard of the myth of the paranoid graybeard UNIX sysadmin. I personally know at least 60% of the people in my city who are qualified to configure high-end Cisco gear - I can count them on my hands - and they're nowhere near experts. A "security expert" has maybe been to a sales event marketed as training and knows, at most, that if you absolutely need security, you should install Norton or Symantec anti-virus software. No one ever inquires into the horrendous security engineering of the proprietary LOB applications they're completely locked in. Encryption is on the "yeah, it would be nice, but let's not get our heads in the clouds" list, even in healthcare. No one thinks it's a problem that we all share the same code for the doors and it hasn't changed in living memory despite extensive staff turnover, that the cameras haven't worked in years, that they key to the server closet is kept in a neighboring desk, that the that everyone's passwords are on post-it notes under their keyboards, that all administration accounts have pretty much the same password. No one thinks it's a problem that half the switching equipment is in an unlocked closet in a patient-accessible hallway. No one thinks it's a problem that we don't even bother with badging. The "security policy" was copied and pasted out of a kit without even having been read. Don't bother with companies who employ someone who's heard of Matasano or Bruce Schneier. Don't bother with companies whose IT contractors employ someone who's heard of Matasano or Bruce Schneier. Don't bother with people who know what pf is, who understand that VPN is not a Cisco product, or who might ever have bothered setting up appropriate ACLs on their network shares. You don't need to find a place where a skilled adversary overlooked something. There are hundreds of thousands of businesses that pay top dollar to IT firms that don't even try. Hit a small business in the Midwest, medical or otherwise. They won't even notice.