Ask HN: Security Strategy Buildung Blocks

An IT security strategy aims to ensure confidentiality, integrity, and availability of IT systems and information. This has to be traded off against economic and practical realities. What building blocks do you consider for a security strategy?

Examples are

- Deep defense. Consider everything hostile. No unencrypted traffic over the network. Spectre attacks matter a lot because you cannot trust other users on the host.

- Tough on the outside, soft on the inside (also M&M security). Try hard to keep bad guys of your intranet but trust your internal users. Spectre attacks don't matter because you trust the other users on the host.