I pick number four: education. Which goes back to my point, that we need some sort of public awareness day on what Internet security _really_ is, or something - I don't really care what it is - to change the narrative. Otherwise we're going to have some huge disaster to some major infrastructure because of an unprotected remote connection like the article shows, and the company that committed it will likely cover up the cause.