Working group offers 25 ways to improve IT security