Specific things to look at

• Default and/or easily guessed passwords for admin accounts should be eliminated

• Be especially careful with programs that allow user interaction (web, command line, ssh)

• In-house code may need more scrutiny than code that is already running on many systems

• Need to keep an eye on security alerts and have a strategy for field upgrades