An important lesson from the breach of a White House unclassified network is that organizations should invest in intrusion detection tools, not just perimeter defenses, SANS's Johannes Ullrich says.