Every device connected to a network is a potential security vulnerability. The first steps to protecting an agency’s systems (and data) are to identify those vulnerabilities and understand the risks involved.