Is it time to consider designing and operating computer systems with an “off-by-default” attitude to proactively defend against such attacks?