Focus on identifying the real risks first and building security around those assets, not the other way around.