How to Define a Winning Security Strategy