Federal agencies with legacy systems should still secure them from attacks