What agency leaders should know when closing web application security gaps to keep public information and critical infrastructure secure.