defining the characteristics of a minimum acceptable “secure” default
configuration for commercial software. Increasingly, major commercial vendors
are shipping their software with such secure default configurations, a practice
originated by manufacturers of security systems such as firewalls and trusted