The problem with Matt M's list of higher priorities is that they are all about user stupidity or host company stupidity. Fine. Granted. But a little bit of misdirection if the question is what can .org do to make itself more secure.