After a particularly pernicious attack against our network, an agency senior admitted: "We have to assume, regardless of our mitigation, that they are still in the network."

All systems can and will be hacked should be your starting assumption. Your network is already hacked is the inescapable conclusion.

Given those assumptions, the focus should shift to data security. First, how is the integrity of the data protected? And second, how can you put the data out-of-reach from an intruder? If you are hacked, and the data is easy to reach, you have a severe vul.

In other words, while perimeter security is still necessary, your focus should shift to data security.