security wheel What asset am I trying to secure? What are the asset's security requirements? What are the risks unique to that asset's security requirements? How do I prioritize and most efficiently address those risks(especially those with heavy impact such as industry and regulatory compliance requirements)? Plan Incident response(IR) Education and training ●Remediation Communications ●Audit resolution Respond Prevent Security operations ●Recovery Rinse and Repeat Security architecture Detect Automated vulnerability scanning Security event and information management(SEIM) Intrusion detection systems (IDS) Anomaly detection systems(ADS) Security audits (including penetration testing) 、嵌入式系统实验室 From:Hacking Exposed Windows:Windows Security Secrets Solutions9/90 security wheel From：Hacking Exposed Windows: Windows Security Secrets & Solutions