First steps in security strategy