> At which point it doesn't matter whether you know an intrusion has occurred, you have to treat it as though it had... Which gets you into benefits/trade-offs

> At which point it doesn't matter whether you know an intrusion has occurred, you have to treat it as though it had... Which gets you into benefits/trade-offs territory; I think it's probably an overreaction for NASA to take their internet facing servers and all computers on the connected networks down to investigate for possible intrusions every time a new security patch comes out. I don't think it's unreasonable for them to do so when they have credible evidence that they've been hacked. (of course, I don't work for NASA, so I have no idea what procedures they have in place)