Begin by assessing your current IT infrastructure. You can’t defend yourself if you don’t know the lay of the land.