Best Practices

• Figure out what your organization's risk management philosophy is. If there is none, start a project to develop one.

• Question everything you know about security, including all we have said. Does it make sense given the threats you are facing? Does it make sense given the technology you have available?

• Look at the tweaks in this book, in the Windows Vista Security Guide, and elsewhere, and analyze whether they can help you mitigate a realistic threat, without imposing undue burden on the organization.

• Take a critical look at how to improve your security awareness program. If you do not have one, start one.