An IT security strategy aims to ensure confidentiality, integrity, and availability of IT systems and information. This has to be traded off against economic and practical realities. What building blocks do you consider for a security strategy?
Examples are
- Deep defense. Consider everything hostile. No unencrypted traffic over the network. Spectre attacks matter a lot because you cannot trust other users on the host.
- Tough on the outside, soft on the inside (also M&M security). Try hard to keep bad guys of your intranet but trust your internal users. Spectre attacks don't matter because you trust the other users on the host.
I.e. in a hospital medical data has to be immeadiatly available to all medical staff to react quickly. However, if medial data leaks (i.e. about a celebrity or in large scale) the bad guy can be caught by looking at the access logs to the data.