Security strategy: From requirements to reality