A good starting point is to analyze and understand the flow of sensitive data and then identify critical assets and their vulnerabilities, assess the risk level for each attack vector and prepare a staged working plan to close each critical vulnerability in the order of the severity of the risk it presents to the most critical data.