Threats to the enterprise have trended away from simply assaulting vulnerabilities in the perimeter to more pervasive attacks that cause damage, disruption to the business, and significant financial loss. Attackers are no longer hobbyists making a name for themselves, but well-sponsored and resourced professionals seeking monetary profit. As the threat landscape continues to evolve and mature, there is a greater need for enterprise security professionals to take a more holistic approach to security. The day when we could simply apply technology to the problem is long gone. Today, we need a strategic security approach that includes people, process and technology to provide the most robust and resilient security posture. John Stewart discusses the essential practices of enterprise security, shares lessons learned, and provides his perspective on the value of developing an embedded security practice in your organization.