We have to assume failure is going to happen--protection will fail. Once protection fails, you need to ensure that you've put detection in place, and when you put detection in place, you look for where your protection has been breached. When you find it, you implement a reaction plan.
Please to comment