“The Pentagon failed to make cybersecurity for its multibillion-dollar weapons systems a major focus until recently despite years of warnings”. They are studying what can be done retrospectively. bloomberg.com/news/articles/…
Once you bake in insecurity it is impossible to bolt on.
I was involved in Microsoft’s complete rewrite of IIS for IIS 6. IIS 5 couldn’t be hardened after it was built with insecure design and practices.
The IIS 6 security team of consultants from @stake included @window @chriseng @daveaitel @dildog @fswiderski
I learned more working with those folks on that project than any other.
