Hot spots

The following are hot spots for security researchers to focus on and infosec pros to worry about: Protocols that support internet infrastructure like DNS and BGP.
Web servers
Database listeners (if you own a web server, pivot off it and this is the next stop out of the DMZ, also all the data is in there :)
Protocols you just can't turn off or block if there is a worm, like SMB
Middleware and anything that transmits a password- if its not encypted its no good.
Crazy virtualisation near trust zone boundaries - misconfigure vmotion, SAN or load the wrong vm and you could have a database on the net