The biggest issue with best practice guides
Is that the people that really need to read them are too lazy to do so, or feel "My system isn't important enough to need that". That and the world is flooded with old and/or broken stuff that requires lower levels of security.
Case in point, the other week I bought a WiFi enabled web camera to watch my backyard, but it only supported WEP (And this was in 2014 for fuck's sake...). I imagine that a lot of these new Internet-of-Things devices are in the same boat...
Biting the hand that feeds IT
