How would you compare the SANS Top 20 Critical Security Controls with the Defence Signals Directorate from the Australian government, particularly as control sets for avoiding common application exploits?