>Retaliation is a side show. Focus on hardening. Think of a fort. Forts had defined security controls in the old times. In a fort, you go through a security ro

>Retaliation is a side show. Focus on hardening. Think of a fort. Forts had defined security controls in the old times. In a fort, you go through a security rotation of making sure the pot of boiling oil tips over on time. You practice your smoke signaling so that the appropriate people are notified in the event of a wall breach. You measure your walls and review their height periodically. You protect transports carrying crown jewels. But the only way to make sure all these worked effectively was to write down their processes down and practice them. You need a systematic checklist to control your sensitive environment and protect your fort. In an agile environment, keeping all the processes in your head is painful. By prescribing to a series of security rotations (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) you can provide accountability that reasonable steps were taken to build your fort and protect your crown jewels. 1. Boundary Control (e.g. Firewall, Router, Switch) 2. System Hardening (e.g. Chef, Puppet) 3. Data Storage (e.g. SAN, File Servers) 4. Data Encryption (e.g. VPN, TLS, SSH) 5. Malware Protection (e.g. App Isolation Containers) 6. Source Code Analysis (e.g. Unit Testing, Integration Testing, Code Coverage, Linting, Code Formatting, Brakeman) 7. Authorization/Authentication (e.g. LDAP) 8. Physical Access (e.g. Badges) 9. Log Monitoring (e.g. FIM, Logstash, Papertrail, Splunk) 10. Intrusion Prevention (e.g. Snort, Metasploit, Burp suite, Nmap, Nessus, Kismet) 11. Write current processes (e.g. Code review process, Change control process, Log review process, Key Rotation process, Secure Delete process) Its writing down current processes (and following them) that's the missing piece to a holistic security program. The other missing piece to a hardened environment is buy-in from the three primary stakeholders that hold up the fort: Sysadmins, Developers, and Security Officers. Developers don't realize the importance of Source Code Analysis. Is your code even 80% covered? That's a big part of building up a good defense :).