I think your link to the SANs report is broken. Takes reader to InformatonWeek article. Not the SANS page