While these remain useful, the Canvas incident demonstrates that such controls alone do not guarantee operational security ...